Security researchers at The Citizen Lab report that government spyware makers are exploiting global advertising networks to compromise devices through malicious online ads. The University of Toronto lab published its findings Thursday, identifying an Israeli firm, Discover-Tech, as a key enabler.
Discover-Tech operates an advertising platform that allows spyware developers to target specific individuals or devices worldwide with tools designed to steal data invisibly. At least two zero-click spyware producers, Candiru and Bindecy, utilized Discover-Tech's platform. Zero-click spyware can infect devices without requiring the victim to open a message or click a link.
The investigation documented at least 45 Windows computers at media organization Al Jazeera being compromised in 2024 and 2025 using Candiru's spyware after exposure to online advertisements embedded with malicious code. This marks the first confirmed instance of zero-click, government-backed spyware attacks delivered through online advertising channels.
Bill Marczak, a senior researcher at The Citizen Lab, said: "There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action."
Ad networks are built to target specific demographics, devices, and organizations—functionality that can be repurposed for delivering malicious code. While malvertising attacks are not new, the use of online advertisements to facilitate government spyware for silent device compromise represents an escalation in cyber espionage tactics. The ubiquity of online advertising makes complete evasion difficult despite security experts' long-standing advice to install ad-blockers.
Researchers discovered that Discover-Tech's platform, named Controlium, left portions of its source code exposed on login pages, which aided their investigation. The Citizen Lab did not specify which governments were responsible for the attacks.
