Citizen Lab finds zero-click spyware delivered through online ads

Citizen Lab says an Israeli ad platform, Discover-Tech, let spyware makers Candiru and Bindecy aim malicious ads at devices. It describes this as the first confirmed case of government zero-click spyware spread through ads.

Researchers at Citizen Lab say an Israeli company, Discover-Tech, runs an ad platform called Controlium that spyware makers use to reach chosen people or devices. At least two zero-click spyware vendors, Candiru and Bindecy, relied on it. Their tools can compromise a device without any action from the victim, such as opening a message or following a link.

In one case, at least 45 Windows computers at Al Jazeera were infected with Candiru's spyware in 2024 and 2025. Citizen Lab could not say which governments were responsible.

Data left exposed on Discover-Tech's site included login records, some tied to Candiru staff, and billions of ad bidding records. Between March and June 2026, the ads were served across tens of thousands of apps and sites, among them devices used by militaries and government bodies. Whether these ads caused infections is unclear.

Citizen Lab researcher Bill Marczak calls the company the tip of the iceberg. He advises people at risk of being targeted to turn off ad tracking or block ads. Discover-Tech and Al Jazeera did not respond to requests for comment.

This is a short summary by Zaxvix based on the source above. We write our summaries with the help of AI and check them before publishing. For the full story, read the original. Spotted an error? Email hello@zaxvix.com and we will review the article and correct or remove it if needed.