Citizen Lab Finds Zero-Click Spyware in Online Ads Targeting Al Jazeera

Security researchers at the University of Toronto’s Citizen Lab found evidence that commercial spyware was delivered through online ads, letting attackers compromise devices without victims clicking links or opening malicious files.

The investigation identifies Israeli advertising company Discover-Tech as a connection between legitimate advertising networks and spyware vendors. Researchers found that its infrastructure targeted individuals using surveillance tools developed by Candiru and Bindecy, two companies associated with zero-click spyware.

The findings include attacks that affected at least 45 Windows computers at Al Jazeera in 2024 and 2025. Citizen Lab linked the activity to Candiru’s spyware but could not determine which governments were responsible.

How Online Advertisements Delivered Zero-Click Spyware

Online advertising systems let businesses target audiences using information such as device identifiers, IP addresses, and browsing activity. Discover-Tech allegedly exploited these capabilities to identify specific devices and deliver malicious code through advertisements displayed on ordinary websites and applications.

Unlike traditional malicious advertising, which often relies on users clicking deceptive links, these attacks could exploit devices as soon as the advertising content loaded. The victim did not need to interact with the advertisement.

In its October 15 investigation, Citizen Lab described the operation as the first publicly documented technical evidence of government-grade zero-click spyware being delivered through online advertising.

Researcher Bill Marczak said the findings show how advertising infrastructure can identify and compromise selected targets with considerable precision, confirming a threat security experts had previously discussed largely in theoretical terms.

Discover-Tech’s Platform Exposed Spyware Connections

Discover-Tech operated an advertising management platform called Controlium. Researchers discovered that parts of its source code were publicly accessible, allowing them to reconstruct the platform’s interface without logging in.

The dashboard appeared designed to coordinate targeted advertising campaigns that could deliver malicious content to selected users. Citizen Lab also found an unsecured endpoint containing login records linked to Controlium accounts, including those of Candiru and Bindecy employees.

Researchers additionally found billions of advertising bidding records exposed through Discover-Tech’s infrastructure. The records indicated that its advertisements appeared across tens of thousands of websites and mobile applications between March and June 2026.

The data included advertising activity involving networks associated with military organisations, government agencies, critical infrastructure operators and national cybersecurity institutions. However, the presence of an advertisement does not establish that a device was successfully compromised.

Advertising Activity Reached Sensitive International Organisations

Cybersecurity company Confiant collaborated with Citizen Lab to examine the advertising infrastructure. Its researchers identified evidence of potentially malicious advertisements appearing on networks associated with the International Atomic Energy Agency and the International Criminal Court.

Confiant’s technical analysis also documented extensive device identification and tracking capabilities, illustrating how advertising data could help surveillance operators identify people or organisations of interest.

The researchers emphasised that broader advertising records showed the reach of Discover-Tech’s infrastructure, not confirmed spyware infections across every exposed network.

Researchers Warn About Advertising-Based Surveillance

The investigation highlights a growing cybersecurity concern: advertising networks designed to deliver personalised commercial messages can also provide access to individuals targeted for sophisticated surveillance.

Traditional malicious advertising campaigns frequently involve fraudulent websites or deceptive downloads. Government-grade zero-click spyware poses a greater threat because attackers may exploit devices without any deliberate action by the victim.

Citizen Lab recommends that people at heightened risk, including journalists, activists and government employees, disable advertising tracking and consider using ad blockers. Organisations can also reduce exposure by restricting unnecessary advertising content on managed devices.

Discover-Tech and Al Jazeera did not respond to requests for comment on the findings, while Candiru’s operator, Integrity Labs, could not be reached. The governments behind the documented attacks remain unidentified.

The discovery demonstrates how commercial advertising infrastructure can be repurposed for highly targeted surveillance. It also raises questions about the security controls advertising networks use and their ability to prevent malicious operators from exploiting systems that reach billions of devices worldwide.