Citizen Lab says governments are abusing online ads to hack people with ‘zero-click’ spyware
The digital rights unit found evidence that dozens of devices at media organization Al Jazeera were hacked after being shown malicious online ads.
Key points
- Citizen Lab says government spyware makers are abusing online advertising networks to deliver zero-click spyware to devices worldwide.
- The report names Israeli ad firm Discover-Tech as a bridge between advertisers and the mercenary spyware ecosystem.
- At least 45 Windows computers at Al Jazeera were apparently hacked in 2024 and 2025 via Candiru spyware after exposure to malicious ads.
Security researchers at the University of Toronto's Citizen Lab say government spyware makers are abusing global advertising networks to target and hack devices by serving malicious online adverts. A report published Thursday by the digital rights unit said an Israeli company called Discover-Tech allows spyware makers to use its advertising platform to target specific people or devices almost anywhere in the world.
Citizen Lab said Discover-Tech presents itself as a legitimate advertising firm but instead serves as a "bridge between ad vendors and the mercenary spyware ecosystem." The researchers said at least two makers of zero-click spyware, Candiru and Bindecy, used Discover-Tech's platform to target people.
Attacks on Al Jazeera devices
The researchers found that one attack affected at least 45 Windows computers at media organization Al Jazeera. The devices were apparently hacked in 2024 and 2025 via Candiru's spyware after being exposed to online ads packed with malicious code.
Citizen Lab said it wasn't clear which governments were behind the attacks. It said this is the first confirmation of zero-click government-backed spyware attacks being delivered through online ads, potentially putting a vast number of devices around the world at risk.
There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action
— Bill Marczak, a Citizen Lab senior researcher
Exposed records and other targets
Citizen Lab also found a publicly accessible portion of Discover-Tech's site that allowed researchers to download reams of user login records for the Controlium dashboard without a password. Some login details belonged to at least two employees of Candiru and some from Bindecy.
Billions of ad bidding records left exposed on Discover-Tech's website showed its ads were displayed across tens of thousands of mobile apps and websites between March and June 2026. The records show the ads appeared on devices used by militaries, critical infrastructure and national cyber agencies, though it is unclear if they led to infections. Confiant, which worked with Citizen Lab, said it found evidence that potentially malicious ads were similarly shown on networks of the International Atomic Energy Agency and the International Criminal Court.
