Governments Using Online Ads for Zero-Click Spyware Attacks

Security researchers at digital rights unit The Citizen Lab have uncovered a disturbing new methodology in state-sponsored cyberespionage. According to a comprehensive report published by the University of Toronto lab, government spyware makers are increasingly abusing global advertising networks to target and hack connected devices by serving malicious online adverts.

The findings point toward an Israeli company named Discover-Tech, which allegedly operates a platform that bridges legitimate ad vendors with the mercenary spyware ecosystem. While Discover-Tech presents itself as an ordinary advertising firm, its infrastructure has reportedly allowed spyware manufacturers to deploy zero-click exploits with pinpoint precision almost anywhere in the world.

Zero-click spyware is among the most dangerous tools in modern digital warfare because it can infect a device completely invisibly. Victims do not need to open a suspicious message, answer an unknown call, or click on a malicious link. The malware installs itself in the background, often through automated processes triggered simply by loading web content or viewing an advertisement.

The Citizen Lab report provides concrete technical evidence of these techniques in the wild. Researchers discovered that at least two notable makers of zero-click surveillance products, Candiru and Bindecy, utilized the Discover-Tech platform to execute targeted attacks. Among the documented incidents, at least 45 Windows computers belonging to staff at the media organization Al Jazeera were compromised between 2024 and 2025 using Candiru's spyware.

While researchers could not definitively identify which specific governments were behind the directive of these attacks, the implications are severe. This marks the first time security experts have documented concrete proof of zero-click, government-backed spyware being delivered entirely through mainstream online advertising channels, expanding the threat landscape to virtually any internet-connected device.

The abuse of advertising networks has long been a concern for cybersecurity professionals, but leveraging them for state-backed espionage represents a significant escalation. Ad networks are intentionally designed to reach a massive global audience and deliver tailored content based on specific device and user parameters. Unfortunately, bad actors can exploit these exact mechanisms to isolate and attack high-profile individuals.

Discover-Tech's platform, internally referred to as Controlium, featured vulnerabilities in its web-based dashboard that allowed researchers to examine its architecture. The exposed code revealed features seemingly engineered to push malicious payloads alongside standard online advertisements.

In response to these growing threats, privacy advocates continue to emphasize the importance of defense-in-depth strategies, including the installation of robust ad-blockers on both desktop and mobile environments. However, due to the deeply integrated nature of digital advertising across modern applications and websites, escaping the reach of these networks remains a formidable challenge for ordinary users and high-risk targets alike.