Citizen Lab identifies zero-click spyware delivered through online ads
Online advertising tied to zero-click spyware delivery
Citizen Lab has reported what it describes as the first technical confirmation that government-backed zero-click spyware has been delivered through online advertising. The University of Toronto digital rights research unit said malicious advertisements were used to target devices with surveillance tools linked to Candiru and Bindecy, two makers of spyware that can infect a device without a victim opening a message or clicking a link.
The investigation centres on Discover-Tech, an Israeli company whose advertising platform is called Controlium. Citizen Lab said the company presented itself as a legitimate advertising business but functioned as a bridge between advertising vendors and the mercenary spyware ecosystem. The reported arrangement allowed spyware operators to use advertising infrastructure to direct malicious content at particular people or devices.
One identified campaign affected at least 45 Windows computers at Al Jazeera. Citizen Lab said the devices appeared to have been compromised in 2024 and 2025 after exposure to advertisements containing malicious code used to deliver Candiru spyware. The researchers could not determine which governments were responsible for those attacks.
How the Controlium findings were obtained
Citizen Lab said Controlium exposed some of its source code through its login pages. That enabled the researchers to recreate the web-based control-panel dashboard without signing in. The dashboard appeared to be designed to let operators push malicious content to individually selected users alongside advertisements.
The researchers also found a publicly accessible area of Discover-Tech's site from which Controlium dashboard login records could be downloaded without a password. Those records included credentials belonging to at least two Candiru employees and to people associated with Bindecy.
In addition, billions of ad-bidding records were reportedly left exposed. They showed that Discover-Tech advertisements were displayed across tens of thousands of mobile applications and websites between March and June 2026. The records included devices used by militaries, governments, critical-infrastructure organisations and national cyber agencies. Citizen Lab stressed that an ad display does not establish that a device was compromised or infected.
Why advertising infrastructure changes the risk
Advertising networks are built to reach selected audiences, devices and organisations at scale. That reach has long made them attractive for malvertising, but Citizen Lab's evidence ties the delivery mechanism to zero-click government spyware, which can operate without an overt action by the intended target.
“There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action,” Citizen Lab senior researcher Bill Marczak said.
Researchers at ad-quality platform Confiant, which worked with Citizen Lab, found evidence that potentially malicious ads had also appeared on devices connected to the International Atomic Energy Agency and the International Criminal Court. The available information does not show whether those displays led to compromise.
For organisations with staff who may be targeted because of their work, the immediate implication is to review advertising exposure and device privacy settings. Citizen Lab recommends disabling ad tracking or blocking ads altogether for people at elevated risk, while security teams should treat advertising delivery as a potential route for targeted device compromise.