Government spyware is now being delivered through ordinary online ads, according to a new report from the University of Toronto's Citizen Lab. The researchers say an Israeli company called Discover-Tech poses as an ad firm while acting as a "bridge between ad vendors and the mercenary spyware ecosystem," letting clients aim malicious ads at specific people or devices.
At least two zero-click spyware makers, Candiru and Bindecy, used the platform, Citizen Lab says. Zero-click means the victim doesn't have to tap a link or open anything. One campaign hit at least 45 Windows computers at Al Jazeera in 2024 and 2025 through Candiru spyware hidden in ads. The lab couldn't say which governments were behind the attacks, but calls this the first confirmed case of zero-click government spyware delivered this way.
"Now for the first time, we have concrete technical evidence showing this process in action," senior researcher Bill Marczak told TechCrunch.
Discover-Tech's own security didn't help it. Its dashboard, called Controlium, left source code exposed on its login pages, and a public part of the site let researchers download login records, including some belonging to Candiru and Bindecy employees. Billions of exposed ad bidding records show the ads ran across tens of thousands of apps and websites between March and June 2026, reaching devices tied to militaries, governments, and critical infrastructure. Ad-quality firm Confiant, which worked on the investigation, found potentially malicious ads on networks at the International Atomic Energy Agency and the International Criminal Court. It's not clear how many of those ad views led to an infection.
— via TechCrunch