Citizen Lab Reveals Governments Exploit Online Ads to Deploy Zero-Click Spyware

Image: TechCrunch · Source

Researchers at Citizen Lab uncovered that government-associated spyware developers use online advertising platforms to silently hack devices globally with zero-click spyware, including incidents targeting Al Jazeera's computers.

Security researchers at the University of Toronto's Citizen Lab have reported that government-linked spyware operators are abusing online advertising networks to launch zero-click spyware attacks. Their investigation highlighted an Israeli company's platform, Discover-Tech, which serves spyware makers by enabling the delivery of malicious advertisements tailored to infect targeted devices globally.

According to Citizen Lab's October 2026 report, Discover-Tech masquerades as a legitimate ad firm but functions as an intermediary, connecting commercial advertising with mercenary spyware vendors like Candiru and Bindecy. These firms produce zero-click spyware capable of compromising devices without user interaction, such as opening a message or clicking a link.

The researchers documented an attack on at least 45 Windows computers at the media outlet Al Jazeera. These devices were compromised across 2024 and 2025 through exposure to online ads containing concealed malicious code linked to Candiru's spyware.

While the exact government actors behind these hacking campaigns remain undisclosed, Citizen Lab emphasized this as the first confirmed instance of government-backed zero-click spyware being disseminated through online advertisement channels. This revelation exposes a potential broad risk to millions of connected devices.

Bill Marczak, a senior researcher at Citizen Lab, stated, “There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action.”

Citizen Lab also exposed several operational details about Discover-Tech's platform, known internally as Controlium. The platform’s publicly accessible login pages inadvertently revealed source code, enabling researchers to reconstruct the control dashboard that is used to push malicious content alongside ads directly to specified targets.

Additionally, the team discovered unsecured login records for Controlium users, including employees affiliated with Candiru and Bindecy, confirming direct use of the platform by known spyware-makers. Billions of ad bidding records were also found exposed, showing ads were served across tens of thousands of apps and websites from March to June 2026. These adverts reached devices within sensitive sectors, including military, government, critical infrastructure, and cyber agencies, although it is unclear how many resulted in successful device compromises.

Further collaboration with the ad quality firm Confiant revealed similar malvertising campaigns affecting networks belonging to the International Atomic Energy Agency and the International Criminal Court.

Marczak warned that Discover-Tech represents likely only a fraction of such operations, urging potential targets to disable ad tracking or employ ad-blockers to mitigate risk.

Neither Al Jazeera nor Discover-Tech responded to requests for comment, and attempts to reach Candiru’s parent company, Integrity Labs, were unsuccessful.

This investigation highlights a significant escalation in how sophisticated spyware is delivered, exploiting commercial ad infrastructures to silently and precisely target victims without any actions required on their part, raising urgent questions about digital security and privacy worldwide.