Government-backed Hackers Exploit Online Advertising Networks for Malicious Spyware

Security researchers have uncovered a disturbing trend of governments using online advertising networks to hack people's devices with sophisticated "zero-click spyware.

According to a new report by The Citizen Lab at the University of Toronto, an Israeli company called Discover-Tech has been exploited by government-backed spyware makers to target specific individuals or devices worldwide. This platform presents itself as a legitimate advertising firm but acts as a bridge between ad vendors and the illicit spyware industry.

Citizen Lab researchers have identified at least two zero-click spyware makers, Candiru and Bindecy, that used Discover-Tech's platform for their operations. These companies provide surveillance products capable of infecting devices without requiring users to open messages or click on links.

The report highlights one notable case in which 45 Windows computers belonging to Al Jazeera were hacked via Candiru's spyware between 2024 and 2025. The malware was delivered through online ads containing malicious code that exploited vulnerabilities in the devices.

The use of online advertisements as a vector for malware delivery is not new, but the recent discovery by Citizen Lab highlights an alarming escalation in the tactics employed by hackers. This time, however, it appears that government-backed actors are involved, using sophisticated zero-click spyware to silently hack into devices.

Citizen Lab's research suggests that governments may be exploiting vulnerabilities in online advertising networks to target specific individuals or devices with malicious code. The ability of ad networks to reach almost any internet-connected device worldwide makes them an attractive vector for hackers seeking to expand their reach.

The abuse of access to advertising networks is a well-documented tactic, and security experts have long warned about the risks associated with malvertising attacks. These can involve targeting specific individuals or devices with malicious code, often masquerading as legitimate ads.

The use of online advertisements to deliver powerful government spyware represents a significant escalation in the tactics employed by hackers. While ad-blockers are available to help prevent unwanted ads from being displayed on desktop and mobile screens, including within apps, the ubiquity of online advertising makes it challenging to entirely avoid the industry's reach.

Security experts have been cautioning people about the risks associated with online advertising for years, but the recent discovery by Citizen Lab underscores the need for heightened vigilance in this area.

The investigation by Citizen Lab has revealed a disturbing aspect of online advertising, where governments may be exploiting this platform to deploy 'zero-click' spyware. The researchers discovered that Discover-Tech's Controlium platform left its source code exposed on login pages, allowing them to recreate the web-based control panel dashboard without logging in.

Upon further investigation, Citizen Lab found a publicly accessible portion of Discover-Tech's site that enabled them to download user login records for the Controlium dashboard without needing a password. This exposed sensitive information belonging to employees of spyware maker Candiru and Bindecy, among others.

The researchers also uncovered billions of ad bidding records on Discover-Tech's website, which revealed that its ads were displayed across tens of thousands of mobile apps and websites between March and June 2026. These records showed that the ads targeted devices used by militaries, governments, critical infrastructure, and national cyber agencies.

It remains unclear whether the displayed ads resulted in a compromise or infection, but the sheer scope of the exposed data raises serious concerns about the potential for exploitation. The investigation highlights the need for greater vigilance in online advertising, where governments may be using this platform to deploy malicious content.

Security researchers at Confiant found evidence that potentially malicious ads were shown on devices connected to the networks of the International Atomic Energy Agency and the International Criminal Court, further underscoring the risks associated with this type of exploitation.

Citizen Lab's Marczak emphasized that Discover-Tech is likely just a small part of a larger issue, warning that individuals may be at risk due to their online activities or affiliations.

To mitigate this threat, Marczak advised people to take proactive measures by disabling ad tracking on their devices or blocking ads altogether. This step can help prevent potential malicious activity from occurring through seemingly innocuous online advertisements.

Despite the revelations about Discover-Tech and Candiru's exploits, some entities involved have yet to respond to inquiries about the hacks. Al Jazeera and Discover-Tech did not provide comments when contacted, while Integrity Labs, the maker of Candiru spyware, could not be reached for a statement.

The growing concern over online security highlights the need for individuals and organizations to take steps to protect themselves from potential threats lurking in digital advertisements.

Governments around the world have been found to be exploiting online advertisements to secretly install zero-click" spyware on unsuspecting individuals' devices.

This malicious tactic involves infiltrating users' systems without requiring any interaction or action from them, making it extremely difficult for security measures to detect and prevent. The revelation underscores the growing concern over online security and highlights the need for vigilance in protecting against potential threats lurking in digital advertisements.