Spyware rode ordinary ad auctions, and Europe should treat adtech as a security risk

On 15 October, Citizen Lab at the University of Toronto published research saying that an Israeli company, Discover-Tech, lets makers of government spyware use its advertising platform, Controlium, to reach chosen people and devices. According to the researchers, at least two zero-click spyware vendors, Candiru and Bindecy, used it. Zero-click tools can take over a device without the victim opening a message or following a link.

Citizen Lab says at least 45 Windows computers at Al Jazeera were infected with Candiru's spyware in 2024 and 2025 after being exposed to ads carrying malicious code. The lab could not say which governments were responsible. It calls this the first confirmed case of government zero-click spyware delivered through online ads. Discover-Tech and Al Jazeera did not respond to requests for comment, according to TechCrunch.

The ad auction as a delivery system

The researchers found data left exposed on Discover-Tech's website. It included Controlium login records, some tied to at least two Candiru employees and some to Bindecy staff, and billions of ad bidding records. Those records show ads displayed across tens of thousands of apps and sites between March and June 2026, including on devices used by militaries, governments, critical infrastructure operators and national cyber agencies. Confiant, an ad quality firm that worked with Citizen Lab, said potentially malicious ads also reached systems at the International Criminal Court and at the UN nuclear watchdog, the IAEA. Whether those ads led to infections is not known.

Malicious ads are old news. What changes here is the precision. Ad systems exist to identify a type of person or device and put content in front of them, with no action needed from the viewer. That is exactly what a zero-click attack needs. The same bidding data that tells an advertiser who you are and where you work also tells an attacker where to aim.

Why this is a European question

The IAEA sits in Vienna and the ICC in The Hague. If potentially malicious ads reached their networks, the same route is open to European ministries, energy companies and newsrooms, including in Sweden. An official reading a news app on a work phone is, in effect, part of an auction that anyone with a buyer account can join.

In Europe, ad targeting has mostly been handled as a privacy and consumer matter. In our view that framing is now too narrow. The Digital Services Act already asks the largest platforms to assess systemic risks, and the NIS2 directive asks essential entities to manage risks in their supply chains. We think both should be read to cover the ad supply chain as a possible attack path. That would mean ad exchanges and intermediaries reaching EU users checking who buys narrowly targeted placements, platform risk assessments covering malicious ad delivery, and public bodies and critical operators treating ad tracking on work devices as a security risk to manage.

The strongest objection

A reasonable reader could say this is one problematic firm, and that tightening rules would punish an ad economy that pays for free journalism, including much of the Swedish press. Vetting costs would fall hardest on small players, and blocking ads hurts publishers.

We take that seriously. But we are not arguing for banning targeting. We are arguing for knowing your customer, the way banks must. Marczak calls Discover-Tech the tip of the iceberg. If one company could get ads in front of military and government devices, the gap looks structural rather than isolated. And the most urgent step is cheap: switching off ad tracking or blocking ads on high-risk work devices does not break the open web for everyone else.

Much remains uncertain. We do not know which governments ordered the Al Jazeera attacks, whether the 2026 ads infected anyone, or how many similar platforms exist. Watch for responses from ad exchanges that sold inventory to Discover-Tech, and for whether EU regulators pick this up.

Our view

We think the online advertising system has become a national-security attack surface, and Europe should regulate it as one. Ad-targeting data and the vetting of ad buyers belong in security rules such as the DSA and NIS2, not only in privacy debates. Until then, organisations handling sensitive work should follow Citizen Lab's advice and turn off ad tracking or block ads on work devices.