Malicious online ads apparently delivered Candiru spyware to at least 45 Windows computers at Al Jazeera during 2024 and 2025, according to Citizen Lab. Its researchers couldn’t identify the governments responsible for attacking the media organization.
A report published Thursday sets out Citizen Lab’s findings. The digital rights unit at the University of Toronto investigates surveillance and digital rights abuses. In this investigation, it describes government spyware makers using global advertising networks to select devices and hack them. Researchers say Discover-Tech, an Israeli advertising company, lets spyware makers use its platform to reach specific people or devices almost anywhere worldwide with software that can steal data without being detected.
Citizen Lab calls the findings the first confirmed instance of online ads carrying zero-click government-backed spyware attacks. Citizen Lab says the approach could potentially put vast numbers of devices worldwide at risk of being targeted and hacked.
“There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action,” said Bill Marczak, a Citizen Lab senior researcher, ahead of the report’s release.
Discover-Tech presents its business as legitimate advertising, but the researchers call it a “bridge between ad vendors and the mercenary spyware ecosystem.” Citizen Lab identified at least two zero-click spyware makers, Candiru and Bindecy, that used the platform to target people. Their surveillance products can infect devices even when users haven’t opened a message or clicked a link.
Source code left exposed on Discover-Tech’s login pages let researchers rebuild the browser-based dashboard for its Controlium platform without logging in. In the researchers’ assessment, it “appears to be specifically designed to allow them to push malicious content to individual targeted users alongside advertisements.”
Controlium’s control panel for advertising/spyware. Citizen Lab supplied the screenshot.
Citizen Lab also located an open section of Discover-Tech’s website where large quantities of Controlium login records could be downloaded without a password. Among the entries were login details belonging to at least two Candiru employees, as well as some people at Bindecy.
The site also exposed billions of ad-bidding records, researchers said. They show Discover-Tech’s ads appeared on tens of thousands of mobile apps and websites between March and June 2026, including on devices used by militaries, governments, critical infrastructure, and national cyber agencies. The records don’t establish whether displaying those ads resulted in an infection or any other compromise.
Confiant, an ad quality platform collaborating with Citizen Lab on the investigation, reported a related discovery. Its researchers found evidence that devices connected to the International Atomic Energy Agency’s and the International Criminal Court’s networks received potentially malicious ads.
Hackers have long pursued access to advertising networks partly because they reach almost any internet-connected device in the world. Ad networks exist to show specific ads to chosen people, devices, and organizations, but the same targeting can be abused to send malicious code to specific people or devices. Malvertising has existed for years, but using ads to deliver powerful government spyware that silently infects devices marks a notable escalation.
Neither Al Jazeera nor Discover-Tech answered requests for comment on the hacks. Candiru maker Integrity Labs couldn’t be contacted for comment.
For years, security and privacy experts have recommended using ad blockers to stop ads from appearing on desktop and mobile screens, including inside apps. Online advertising is so widespread, though, that avoiding the industry entirely is difficult. Calling Discover-Tech “surely just the tip of the iceberg,” Marczak urged people to act to protect themselves.
“If you might be targeted based on who you are or what you do, it’s time to disable ad tracking on your devices or even block ads altogether,” said Marczak.
