Zero‑Click Government Spyware Delivered Through Online Ads, Citizen Lab Finds

Report Unveils New Abuse of Advertising Infrastructure

Security researchers at the University of Toronto’s Citizen Lab released a report on Thursday that details how an Israeli firm, Discover‑Tech, allegedly provides spyware manufacturers with access to a global ad network. According to the investigation, Discover‑Tech’s platform, named Controlium, is marketed as a legitimate advertising service but functions as a conduit for mercenary zero‑click spyware, enabling attackers to silently harvest data from targeted devices without the need for a user to open a message or click a link.

Technical Evidence Shows Exposed Infrastructure

The researchers discovered that portions of Controlium’s source code were publicly visible on its login pages, allowing them to reconstruct the web‑based control panel. This dashboard apparently permits operators to push malicious content alongside legitimate ads to specific users. In addition, a publicly accessible section of Discover‑Tech’s site exposed user login records for the dashboard, including credentials belonging to employees of spyware maker Candiru and another firm, Bindecy. Bill Marczak, a senior researcher at Citizen Lab, said the findings represent the first concrete technical proof that online ads can be weaponized to deliver powerful government‑backed zero‑click spyware.

Attack on Al Jazeera and Global Reach

One confirmed incident involved at least 45 Windows computers at the media organization Al Jazeera. The devices were compromised in 2024 and 2025 after encountering online advertisements laced with malicious code, ultimately delivering Candiru’s spyware. The report notes that the attacks could be linked to government sponsors, though the specific state actors remain unidentified. Separate analysis by ad‑quality platform Confiant, which collaborated with Citizen Lab, identified potentially malicious ads displayed on networks used by the International Atomic Energy Agency and the International Criminal Court.

Massive Ad‑Bidding Data Reveals Broad Exposure

Billions of ad‑bidding records left on Discover‑Tech’s website showed that between March and June 2026 the platform’s ads were served across tens of thousands of mobile apps and websites. The logs indicated that the advertisements reached devices associated with militaries, governments, critical infrastructure providers, and national cyber agencies, underscoring the potential scale of the threat. While it is unclear whether any of these displayed ads led to actual compromises, the breadth of exposure highlights the vulnerability of the advertising ecosystem.

Recommendations for Users and Defenders

Given the ability of attackers to target individuals based on identity or activity, Marczak urged users to disable ad tracking or employ ad‑blocking tools to reduce exposure. “If you might be targeted based on who you are or what you do, it’s time to disable ad tracking on your devices or even block ads altogether,” he said. Security experts have long recommended ad blockers as a defensive measure, but the ubiquity of online advertising makes complete avoidance challenging.

Responses and Ongoing Investigation

Al Jazeera, Discover‑Tech, and Integrity Labs—the parent company of Candiru—did not respond to requests for comment. Citizen Lab emphasized that Discover‑Tech is likely only one element of a larger network and called for continued vigilance and defensive actions by users and organizations.