Citizen Lab uncovers first confirmed zero-click spyware attacks delivered through online ad networks

Security researchers at Citizen Lab have documented what they describe as the first confirmed case of government-backed zero-click spyware being delivered through online advertising networks, according to TechCrunch. The findings centre on an Israeli company, Discover-Tech, whose advertising platform served as a delivery channel for mercenary spyware vendors targeting people around the world.

What the report found

According to the Citizen Lab report, published Thursday, Discover-Tech presents itself as a legitimate advertising firm but in practice operates as a "bridge between ad vendors and the mercenary spyware ecosystem." Its platform, called Controlium, allowed spyware makers to aim malicious adverts at specific individuals or devices almost anywhere.

At least two zero-click spyware vendors used the service: Candiru and Bindecy. Both sell surveillance tools that can infect a device without the victim opening a message or clicking a link. The most concrete incident identified by the researchers affected Al Jazeera, where at least 45 Windows machines were hacked in 2024 and 2025 after users were shown ads loaded with malicious code tied to Candiru's spyware.

Citizen Lab could not determine which governments commissioned the attacks. TechCrunch reports that Al Jazeera and Discover-Tech did not respond to requests for comment, and Candiru's parent company Integrity Labs could not be reached.

How the researchers got in

The lab's insight came largely from Discover-Tech's own weak security practices. Controlium's login pages leaked source code, letting the researchers reconstruct the platform's web-based control panel without signing in. That dashboard, the researchers wrote, "appears to be specifically designed" to push malicious content to individually targeted users alongside advertisements.

A publicly accessible portion of Discover-Tech's site also handed out user login records without requiring a password, including credentials belonging to at least two Candiru employees and several linked to Bindecy. Separately, billions of ad bidding records were left exposed, revealing that the platform's ads ran across tens of thousands of mobile apps and websites between March and June 2026.

The potential blast radius

Those bidding records show ads reaching devices belonging to militaries, governments, critical infrastructure operators and national cyber agencies, though Citizen Lab says it is unclear whether any of those impressions resulted in an actual infection. Researchers at Confiant, an ad quality platform that worked with Citizen Lab on the investigation, found evidence that potentially malicious ads were also displayed on devices on the networks of the International Atomic Energy Agency and the International Criminal Court.

Why it matters

Advertising networks can reach almost any internet-connected device, and the targeting machinery built to find particular audiences can be repurposed to single out individuals with hostile code. Malvertising itself is not new, but Citizen Lab's findings mark the first technical confirmation that the ad ecosystem is being used as a precision delivery channel for state-grade zero-click spyware, an escalation that could put a vast number of devices at risk.

Bill Marczak, a senior researcher at Citizen Lab, said speculation about this capability had circulated for years. "There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action," he said ahead of the report's release.

Marczak also warned that Discover-Tech is "surely just the tip of the iceberg," and advised anyone who could be targeted because of who they are or what they do to disable ad tracking on their devices, or block ads altogether.

Practical takeaways

For organisations, the report is a reminder that ad networks are an attack surface, and that content delivered through them should be treated with the same suspicion as any other untrusted input. For individuals in high-risk roles such as journalists, activists and lawyers, an ad blocker now qualifies as a security control rather than merely a convenience.