Security researchers at the University of Toronto’s Citizen Lab have uncovered that governments are exploiting global online advertising networks to deploy zero-click spyware attacks. These attacks, which do not require user interaction such as clicking links or opening messages, are delivered via malicious online ads. The investigation revealed that an Israeli company, Discover-Tech, uses its advertising platform to facilitate this spyware distribution, effectively bridging ad vendors with spyware makers who target individuals or devices globally.

Citizen Lab’s report highlights that two zero-click spyware vendors, Candiru and Bindecy, have utilized Discover-Tech’s platform to infect targets. Notably, at least 45 Windows computers at the media organization Al Jazeera were compromised in 2024 and 2025 through malicious ads carrying Candiru’s spyware. This discovery marks the first confirmed case where government-backed spyware has been distributed through online advertisements, raising concerns over the potential scale of vulnerable devices worldwide.

The researchers were also able to access parts of Discover-Tech’s platform, called Controlium, including exposed source code and login records without passwords. This breach allowed them to examine how the platform pushes malicious content alongside ads and to identify user credentials linked to Candiru and Bindecy employees. Furthermore, billions of ad bidding records showed that these malicious ads appeared across tens of thousands of websites and mobile apps between March and June 2026, reaching devices used by militaries, governments, and critical infrastructure entities.

While it remains unclear which governments are responsible for these attacks, Citizen Lab warns that this method of spyware delivery is only the beginning. They urge individuals who may be targets to take defensive measures such as disabling ad tracking or blocking ads entirely to reduce exposure. Efforts to combat this threat are complicated by the widespread and embedded nature of online advertising, which is difficult to avoid across platforms and devices.