Government spyware operators have used online advertising networks to secretly hack devices. A report by Citizen Lab has found that these networks allow them to steal data without users clicking on malicious links.
The University of Toronto-based digital rights research group said Israeli firm Discover-Tech provided an advertising platform that helped spyware developers target specific people and devices worldwide.
The report, published on Thursday, identified spyware makers Candiru and Bindecy as users of the platform. Both companies develop zero-click spyware, which can infect devices without requiring victims to open messages or click links.
Also Read: ASOS Cyber Breach: Hackers Accessed Customer Data Through Employee Account
Citizen Lab researchers found evidence that at least 45 Windows computers at Al Jazeera were affected by an attack involving Candiru spyware in 2024 and 2025. The devices were exposed to online advertisements carrying malicious code.
The researchers could not identify the governments behind the operation. They said the findings offer the first confirmed technical evidence of government-backed zero-click spyware being delivered through online advertisements.
“There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action,” said Bill Marczak, a senior researcher at Citizen Lab.
Researchers said exposed website code allowed them to recreate the platform’s control panel without logging in. They also accessed login records and found details linked to employees of Candiru and Bindecy.
Also Read: UAE Faces 800,000 Daily Cyberattacks as AI Accelerates Hacking Threats
Citizen Lab found billions of advertising-bidding records on Discover-Tech’s website. These records indicated that ads appeared across tens of thousands of websites and mobile applications between March and June 2026.
Some advertisements appeared on devices connected to military, government, critical infrastructure and national cybersecurity networks. However, researchers could not confirm whether those exposures led to infections.
Researchers working with advertising security firm Confiant also found potentially malicious ads on networks associated with the International Atomic Energy Agency and the International Criminal Court.
Marczak warned that Discover-Tech might represent only a small part of a wider problem. He urged potential targets to restrict advertising tracking or block ads altogether.