Digital rights researchers from The Citizen Lab have uncovered how government-developed spyware operators are leveraging global online advertising infrastructure to secretly compromise devices by delivering weaponized advertisements.
In a report released Thursday, the University of Toronto-based research group detailed how an Israeli firm named Discover-Tech offers its advertising platform as a conduit for spyware distributors to reach specific individuals or devices worldwide with tools that can covertly extract sensitive data.
According to the findings, Discover-Tech presents itself as a standard advertising company but functions more like a “bridge between ad vendors and the mercenary spyware ecosystem,” according to Citizen Lab.
The investigation revealed that at least two developers of zero-click spyware—Candiru and Bindecy—utilized Discover-Tech’s platform to conduct targeted attacks. These spyware solutions are designed to infiltrate devices without requiring user interaction such as opening messages or clicking links.
Researchers identified one campaign that compromised over 45 Windows machines at media outlet Al Jazeera during 2024 and 2025 through Candiru’s software after victims were exposed to ads embedded with malicious payloads.
“While there had been speculation that online ads could be used to pinpoint and silently compromise targets, we now possess concrete proof of this mechanism unfolding in real-time,” stated Bill Marczak, a senior researcher at Citizen Lab, prior to publishing the report.
Cybercriminals have historically sought methods to exploit advertising systems due to their broad reach across internet-connected devices. Although ad networks aim to help marketers tailor content to particular audiences, they can also be misused to deliver harmful code directly to chosen recipients.
Although “malvertising” tactics aren’t novel, integrating them with advanced government-grade spyware represents a significant escalation in digital surveillance capabilities.
Privacy advocates have long advised users to adopt ad-blocking software on both desktop and mobile platforms, including within applications. However, the pervasive nature of online advertising makes it challenging to fully evade exposure.
The team discovered that Discover-Tech’s platform, internally referred to as Controlium, inadvertently exposed parts of its source code through login interfaces, enabling researchers to reconstruct its web-based control panel without authentication. They claim the interface was clearly built to inject malicious material into targeted users’ sessions alongside regular advertisements.
Additionally, Citizen Lab found an unprotected section of Discover-Tech’s website where login credentials for the Controlium dashboard were publicly downloadable. Among those records were accounts linked to employees from both Candiru and Bindecy.
Furthermore, researchers accessed billions of ad auction logs left unsecured on Discover-Tech’s servers, revealing ads served across tens of thousands of websites and mobile apps between March and June 2026.
These placements included devices associated with military bodies, government agencies, critical infrastructure, and national cybersecurity units—though it remains uncertain whether any resulted in actual breaches.
In collaboration with Citizen Lab, security experts from ad verification firm Confiant identified similar patterns of suspicious ad activity targeting networks used by organizations like the International Atomic Energy Agency and the International Criminal Court.
Bill Marczak warned that Discover-Tech likely represents only a small part of a larger problem, urging proactive measures among at-risk populations. “If your profile or role puts you at risk, consider disabling ad tracking or employing ad blockers entirely,” he advised.
Requests for comment from Al Jazeera, Discover-Tech, and Integrity Labs—the developer behind Candiru—went unanswered.