Security researchers at the University of Toronto’s Citizen Lab say government spyware makers are abusing global advertising networks to target and hack devices by serving malicious online adverts, in a report published on Thursday covered by TechCrunch. The lab says an Israeli company, Discover-Tech, presents itself as a legitimate advertising firm while acting as a bridge between ad vendors and the mercenary spyware ecosystem through a platform it calls Controlium.
Citizen Lab says at least two makers of zero click spyware, Candiru and Bindecy, used the platform, and that one attack infected at least 45 Windows computers at the media organisation Al Jazeera in 2024 and 2025 after exposure to ads carrying malicious code. The researchers reconstructed Controlium’s control panel from source code exposed on its login pages and found billions of ad bidding records left publicly accessible, showing ads displayed across tens of thousands of apps and websites between March and June 2026, including on networks used by militaries, governments and critical infrastructure, although it is unclear whether those displays led to infections.
Citizen Lab senior researcher Bill Marczak said this is the first concrete technical evidence of zero click, government backed spyware being delivered through online ads, and called Discover-Tech the tip of the iceberg. Security firm Confiant, which worked on the investigation, found evidence of potentially malicious ads shown on devices on the networks of the International Atomic Energy Agency and the International Criminal Court. Al Jazeera and Discover-Tech did not respond to requests for comment, and Candiru’s maker could not be reached.