Citizen Lab: Governments using online ads for zero-click spyware

Security researchers at the University of Toronto's digital rights unit, Citizen Lab, have published a groundbreaking report detailing how government spyware makers are abusing global advertising networks. According to the findings, these entities are using malicious online adverts to target and hack devices, deploying zero-click spyware capable of invisibly stealing data.

The report focuses on an Israeli company called Discover-Tech, which allegedly presents itself as a legitimate advertising firm. In reality, researchers claim that Discover-Tech serves as a crucial bridge connecting mainstream ad vendors to the mercenary spyware ecosystem. This infrastructure allows surveillance products to target specific people or devices almost anywhere in the world.

Citizen Lab identified at least two prominent makers of zero-click spyware, Candiru and Bindecy, utilizing Discover-Tech’s platform. These surveillance products are exceptionally dangerous because they can infect devices without requiring the victim to open a message, answer a call, or click on a malicious link. The stealth nature of these exploits makes them nearly impossible for everyday users to detect.

The investigation uncovered a specific attack that compromised at least 45 Windows computers at the media organization Al Jazeera. These devices were reportedly hacked between 2024 and 2025 using Candiru’s spyware, which was delivered after the systems were exposed to online ads packed with hidden malicious code. Although the specific government clients behind these operations remain unclear, the findings confirm that ad-based zero-click attacks are an active reality.

Bill Marczak, a senior researcher at Citizen Lab, emphasized the significance of the discovery. While experts have long theorized about the potential misuse of programmatic advertising for pinpoint cyberattacks, this report provides the first concrete technical evidence of the process operating in the wild. Hackers have long coveted ad networks due to their vast global reach and ability to deliver content to nearly any internet-connected device.

Advertising networks are fundamentally designed to help advertisers target specific demographics, device types, and organizations with tailored marketing. However, this precision can easily be subverted. While malvertising is not a new phenomenon, leveraging mainstream advertising infrastructure to distribute powerful state-backed spyware represents a severe escalation in digital espionage.

Security and privacy advocates have long recommended using ad-blockers to mitigate tracking and basic threats. However, the sheer ubiquity of online advertising makes total avoidance extremely difficult. The investigation into Discover-Tech was made possible partly because the company's platform, known as Controlium, left source code exposed on its login pages, allowing researchers to reconstruct its web dashboard and analyze its operations.

In conclusion, the Citizen Lab report exposes a alarming loophole in global digital infrastructure. By weaponizing the very networks that power the modern web, spyware vendors and their government clients have found a pervasive new vector for intrusion. This development underscores the urgent need for tighter security controls across the advertising industry and highlights the ongoing challenge of protecting high-risk individuals from state-sponsored surveillance.