Citizen Lab says governments are abusing online ads to hack people with ‘zero-click’ spyware
The digital rights unit found evidence that dozens of devices at media organization Al Jazeera were hacked after being shown malicious online ads.
Citizen Lab said at least two makers of zero-click spyware, Candiru and Bindecy, used Discover-Tech’s platform to target people. Both of these spyware makers provide surveillance products that can infect devices without the victim having to open a message or click on a link.
The researchers found that one attack affected at least 45 Windows computers at media organization Al Jazeera. The devices were apparently hacked in 2024 and 2025 via Candiru’s spyware after being exposed to online ads packed with malicious code.
Citizen Lab said it wasn’t clear which governments were behind the attacks, but said this is the first confirmation of zero-click government-backed spyware attacks being delivered through online ads, potentially putting a vast number of devices around the world at risk of being targeted and hacked.
“There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action,” said Bill Marczak, a Citizen Lab senior researcher, ahead of the report’s release.
While such so-called “malvertising” attacks are not new, using online ads to allow powerful government spyware to silently hack into devices is a notable escalation.
Citizen Lab also found that Discover-Tech’s site had a publicly accessible portion that allowed the researchers to download reams of user login records for the Controlium dashboard without needing a password. Some login details belonged to at least two employees of spyware maker Candiru, as well as some from Bindecy.
The researchers also found billions of ad bidding records left exposed on Discover-Tech’s website, which showed that its ads had ultimately been displayed across tens of thousands of mobile apps and websites between March and June 2026.
The bidding records show that the ads were shown on devices used by militaries, governments, critical infrastructure, and national cyber agencies. However, it’s unclear if the displayed ads resulted in a compromise or infection.
Security researchers with ad quality platform Confiant, which worked with Citizen Lab to investigate, said they found evidence that potentially malicious ads were similarly shown on devices on the networks of the International Atomic Energy Agency, and the International Criminal Court.
Citizen Lab’s Marczak said Discover-Tech is “surely just the tip of the iceberg,” and urged people to take defensive action.
“If you might be targeted based on who you are or what you do, it’s time to disable ad tracking on your devices or even block ads altogether,” said Marczak.
Al Jazeera did not respond to a request for comment about the hacks. Neither did Discover-Tech, and Candiru maker Integrity Labs could not be reached for comment.
When you purchase through links in our articles, we may earn a small commission . This doesn’t affect our editorial independence.
He can be reached via encrypted message at zackwhittaker.1337 on Signal. You can also contact him by email, or to verify outreach, at [email protected] .
Get 50% off a second pass The Disrupt experience is meant to be shared. Get your pass and bring a colleague, partner, or peer at 50% off. Cover more ground by making connections, building momentum, and discovering what’s next in the startup ecosystem.
Bumble agrees to a $1.3B acquisition deal as online dating faces a reset
This AI startup says it can generate permit-ready blueprints in minutes
Elon Musk intensifies attack on Ambani over Starlink India launch delay
Anthropic can’t reliably control its AI agents, it’s cutting off its internal evals from the live internet instead
Batteries are now cheaper than natural gas turbines used at many data centers
