{
  "id": 14684735,
  "title": "Citizen Lab says governments are abusing online ads to hack people with ‘zero-click’ spyware",
  "url": "https://urgent.news/2026/10/15/citizen-lab-says-governments-are-abusing-online-ads-to-hack-people",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-15T10:00:00.000Z",
  "source": {
    "name": "TechCrunch",
    "slug": "techcrunch",
    "url": "https://techcrunch.com/2026/10/15/citizen-lab-says-governments-are-abusing-online-ads-to-hack-people-with-zero-click-spyware/"
  },
  "original_language": "en",
  "account": "Citizen Lab, a digital rights research organization based at the University of Toronto, has uncovered a new threat to online privacy and security. The group's researchers claim that governments are exploiting global advertising networks to deploy \"zero-click\" spyware on unsuspecting victims' devices without them needing to click on a link or open a malicious message. The study, published Thursday, reveals that the Israeli company Discover-Tech is being used by spyware manufacturers to target individuals and devices worldwide with malicious online advertisements.\n\nDiscover-Tech markets itself as a legitimate advertising firm, but it actually serves as a conduit for delivering spyware to targeted individuals or devices. The Citizen Lab researchers identified Candiru and Bindecy as two spyware companies that have utilized Discover-Tech's platform for targeting victims. These spyware tools can infect devices without requiring any interaction from the user, making them particularly dangerous.\n\nOne notable attack affected at least 45 Windows computers at the media organization Al Jazeera in 2024 and 2025. The researchers are uncertain about the governments responsible for these attacks, but the discovery marks the first concrete evidence of zero-click government-backed spyware attacks being delivered through online ads. This could put millions of devices around the world at risk of being targeted and hacked.\n\nAccording to Bill Marczak, a senior researcher at Citizen Lab, this is the first time that such a process has been proven to occur in practice. The researchers found that Discover-Tech's advertising platform, known as Controlium, has exposed some of its source code, allowing the team to recreate the web-based control panel without authentication. The dashboard is designed to push malicious content to targeted users alongside advertisements.\n\nFurthermore, Discover-Tech's website contained publicly accessible login records for at least two employees of Candiru and Bindecy, the two spyware companies found to be using the platform. The researchers also discovered billions of ad bidding records on Discover-Tech's website, which showed that the ads had been displayed on tens of thousands of mobile apps and websites, including those used by militaries, governments, critical infrastructure, and national cyber agencies.\n\nWhile it's unclear if these displayed ads led to any compromises or infections, the revelation has raised serious concerns about the widespread use of online advertising networks and the potential risks they pose to digital security and privacy. Citizen Lab's Marczak urges individuals to take defensive action, such as disabling ad tracking on their devices or blocking ads altogether, to protect themselves from this emerging threat.",
  "summary": "The digital rights unit found evidence that dozens of devices at media organization Al Jazeera were hacked after being shown malicious online ads.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "Techmeme",
        "title": "Citizen Lab details AdFection, a zero-click spyware campaign where an Israeli ad company routed targets to spyware servers and infected dozens of devices (Wired)",
        "url": "https://urgent.news/2026/10/15/citizen-lab-details-adfection-a-zero-click-spyware-campaign-where-an",
        "published": "2026-10-15T10:45:08.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}