Governments Weaponizing Ad Networks to Deploy Zero-Click Spyware, Research Reveals

Government-Backed Spyware Delivered Through Malicious Ads

Security researchers at the University of Toronto's Citizen Lab have uncovered a sophisticated attack infrastructure in which government-affiliated spyware makers are abusing mainstream advertising networks to silently compromise devices worldwide. The researchers published findings Thursday detailing how an Israeli firm called Discover-Tech operates as a bridge between legitimate advertising vendors and mercenary spyware developers, enabling precision targeting of individuals and organizations with zero-click malware that requires no user interaction to infect devices.

The investigation identified at least two spyware makers—Candiru and Bindecy—leveraging Discover-Tech's platform called Controlium to deliver weaponized advertisements. Citizen Lab documented confirmed attacks against at least 45 Windows computers at Al Jazeera during 2024 and 2025, where Candiru's spyware was embedded within online advertisements and executed automatically upon exposure. This marks the first documented instance of government-grade zero-click spyware being delivered through ad networks, fundamentally expanding the threat surface for targeted digital surveillance.

How the Attack Infrastructure Operates

Discover-Tech's Controlium platform was designed specifically to allow spyware operators to inject malicious code into targeted advertisements delivered to individual users alongside legitimate ads. The platform leverages the inherent capabilities of advertising networks to identify and reach specific devices, organizations, and individuals across the internet—features normally used for commercial marketing purposes.

Citizen Lab researchers discovered critical security flaws in Discover-Tech's infrastructure that allowed them to reverse-engineer the company's control panel without authentication credentials. The researchers accessed exposed source code on public login pages and retrieved billions of advertising bidding records from March through June 2026, revealing that malicious ads were displayed across tens of thousands of mobile applications and websites. The ad delivery records indicated exposure on networks belonging to military institutions, government agencies, critical infrastructure operators, and national cyber defense bodies.

Scope of Potential Compromise

While researchers confirmed Candiru and Bindecy were active users of Discover-Tech's platform, the true scale of exploitation remains unclear. The exposed data showed that potentially malicious advertisements were also displayed on networks of the International Atomic Energy Agency and the International Criminal Court, though it remains undetermined whether these exposures resulted in actual device infections.

Citizen Lab senior researcher Bill Marczak characterized Discover-Tech as merely the visible portion of a much larger problem. The research demonstrates that the ubiquity and sophistication of global advertising infrastructure creates an enormous attack surface for state-sponsored surveillance operations. Traditional defensive measures like ad-blockers offer partial protection, but the complexity and scale of modern ad ecosystems make comprehensive evasion nearly impossible for typical users.

Escalation of Malvertising Threat

While malicious advertisements have existed for years, weaponizing them as delivery mechanisms for sophisticated government spyware represents a meaningful tactical escalation. Previous malvertising campaigns typically involved financial fraud or commodity malware; this infrastructure enables precision targeting of journalists, activists, government officials, and critical infrastructure with military-grade surveillance tools that operate invisibly and without user awareness.

The availability of such advertising platforms to spyware developers signals that market-based procurement of surveillance infrastructure has matured substantially. Discover-Tech positioned itself as a legitimate ad-tech company while simultaneously servicing the mercenary spyware industry, demonstrating how dual-use commercial technologies can be corrupted to enable abuse at scale. The researchers found login credentials and other administrative evidence linking Discover-Tech directly to employees of Candiru and Bindecy, confirming operational integration.

Ongoing Risks and Defensive Challenges

The discovery creates immediate practical concerns for high-risk individuals and organizations. Anyone who might be targeted due to their professional role, activism, or identity now faces a threat vector that bypasses traditional security boundaries. Ad networks reach browsers, mobile apps, and embedded web components across hundreds of millions of devices daily, making comprehensive filtering technically and operationally infeasible for most users and organizations.

Researchers urge at-risk populations to disable advertising tracking and implement ad-blocking technologies, though these measures provide imperfect protection. The broader implication suggests that fundamental structural changes to advertising infrastructure may be necessary to prevent future abuse. Neither Discover-Tech, Candiru's parent company Integrity Labs, nor Al Jazeera responded to inquiries regarding the attacks or the company's role in the exploitation.