Citizen Lab says governments are abusing online ads to hack people with ‘zero-click’ spyware
The digital rights unit found evidence that dozens of devices at media organization Al Jazeera were hacked after being shown malicious online ads.
Citizen Lab, a digital rights research organization based at the University of Toronto, has uncovered a new threat to online privacy and security. The group's researchers claim that governments are exploiting global advertising networks to deploy "zero-click" spyware on unsuspecting victims' devices without them needing to click on a link or open a malicious message.
The study, published Thursday, reveals that the Israeli company Discover-Tech is being used by spyware manufacturers to target individuals and devices worldwide with malicious online advertisements.
Discover-Tech markets itself as a legitimate advertising firm, but it actually serves as a conduit for delivering spyware to targeted individuals or devices. The Citizen Lab researchers identified Candiru and Bindecy as two spyware companies that have utilized Discover-Tech's platform for targeting victims. These spyware tools can infect devices without requiring any interaction from the user, making them particularly dangerous.
One notable attack affected at least 45 Windows computers at the media organization Al Jazeera in 2024 and 2025. The researchers are uncertain about the governments responsible for these attacks, but the discovery marks the first concrete evidence of zero-click government-backed spyware attacks being delivered through online ads. This could put millions of devices around the world at risk of being targeted and hacked.
According to Bill Marczak, a senior researcher at Citizen Lab, this is the first time that such a process has been proven to occur in practice. The researchers found that Discover-Tech's advertising platform, known as Controlium, has exposed some of its source code, allowing the team to recreate the web-based control panel without authentication. The dashboard is designed to push malicious content to targeted users alongside advertisements.
Furthermore, Discover-Tech's website contained publicly accessible login records for at least two employees of Candiru and Bindecy, the two spyware companies found to be using the platform. The researchers also discovered billions of ad bidding records on Discover-Tech's website, which showed that the ads had been displayed on tens of thousands of mobile apps and websites, including those used by militaries, governments, critical infrastructure, and national cyber agencies.
While it's unclear if these displayed ads led to any compromises or infections, the revelation has raised serious concerns about the widespread use of online advertising networks and the potential risks they pose to digital security and privacy. Citizen Lab's Marczak urges individuals to take defensive action, such as disabling ad tracking on their devices or blocking ads altogether, to protect themselves from this emerging threat.
Written by urgent.news from TechCrunch's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
