Citizen Lab: governments are hacking devices through ads and zero-click spyware

Citizen Lab, the digital rights unit at the University of Toronto, has published a report claiming that makers of government spyware are abusing global advertising networks to infect devices through malicious ads.

At the heart of the investigation is an Israeli company called Discover-Tech. According to the researchers, it presents itself as a legitimate advertising firm but in fact acts as a "bridge between ad vendors and the mercenary spyware ecosystem." Its platform makes it possible to target almost any device in the world with pinpoint precision.

A first confirmation

Citizen Lab found that at least two zero-click spyware makers — Candiru and Bindecy — used Discover-Tech's platform. Such software infects a device without any action from the victim: there is no need to open a message or click a link.

One attack affected at least 45 Windows computers at the media organization Al Jazeera. According to the researchers, the devices were compromised in 2024 and 2025 using Candiru's spyware after being shown ads laden with malicious code.

"There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action," said Citizen Lab senior researcher Bill Marczak.

Leaks on the platform itself

Discover-Tech's control panel, called Controlium, turned out to be carelessly protected. Part of its source code was left exposed on the login pages, letting researchers recreate the web dashboard without logging in. In their assessment, the interface was specifically designed to push malicious content to individual targets alongside advertisements.

Login records were also exposed: without a password, anyone could download user credentials, including those of Candiru and Bindecy employees. Citizen Lab additionally found billions of ad bidding records showing that the ads ran across tens of thousands of apps and websites between March and June 2026 — including on devices used by militaries, governments, critical infrastructure, and national cyber agencies.

The investigation partner, ad quality platform Confiant, found traces of potentially malicious ads on the networks of the IAEA and the International Criminal Court. Whether any of this led to an actual infection is unclear.

Marczak calls Discover-Tech "surely just the tip of the iceberg" and urges those who might be targeted to disable ad tracking or block ads altogether. Al Jazeera, Discover-Tech, and Candiru's maker Integrity Labs did not respond to requests for comment.

Source: TechCrunch