Friday 16 October 2026
Night Edition
ZOTPAPER

News without the noise

ZOTPAPER
Security

Spyware Makers Use Online Ads to Hack Devices, Citizen Lab Report Finds

Zero-click spyware delivered through advertising networks targets specific people and organisations

By LineZotpaper
Published
Updated
Read Time2 min
Sources3 outlets
Security researchers at the University of Toronto's Citizen Lab have discovered that government spyware makers are abusing global advertising networks to hack devices without the victim needing to click a link or open a message. A new report published Thursday identifies an Israeli company called Discover-Tech as a bridge between ad vendors and the mercenary spyware ecosystem, enabling targeted attacks with zero-click exploits.

Citizen Lab, a digital rights research unit, said that at least two spyware makers used Discover-Tech's platform to target individuals. Candiru and Bindecy, both known for supplying governments with surveillance products, were able to infect devices by serving malicious online adverts, the researchers found.

One attack affected at least 45 Windows computers at media organisation Al Jazeera. The devices were apparently hacked in 2024 and 2025 via Candiru's spyware after being exposed to ads packed with malicious code.

Discover-Tech presents itself as a legitimate advertising firm, according to the report, but instead acts as a pipeline connecting ad vendors to the mercenary spyware industry. The researchers said it was not clear which governments were behind the attacks.

"There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action," said Bill Marczak, a senior researcher at Citizen Lab.

While malicious adverts, or malvertising, are not new, using online ads to enable powerful government spyware to silently hack into devices represents a notable escalation. Ad networks are designed to help advertisers reach specific audiences, but they can be abused to target specific individuals or devices with malicious code. The ubiquity of online advertising makes it difficult to escape the industry's reach entirely. Security and privacy experts have for years recommended using ad-blockers to prevent ads from being displayed on desktop and mobile screens.

§

Analysis

Why This Matters

  • Online ads reach nearly every internet-connected device, meaning targeted spyware attacks could become more widespread and harder to detect.
  • The confirmation of zero-click government spyware delivered through ad networks raises the stakes for journalists, activists and organisations who rely on digital security.
  • If this method becomes common, it could erode trust in online advertising and accelerate the adoption of automated ad-blocking tools.

Background

Malvertising, the use of online ads to distribute malware, has existed for years. However, past attacks typically required a user to click on a malicious ad. The Citizen Lab report marks the first confirmed case of zero-click government spyware being delivered via advertising platforms, where no user interaction is needed. Discover-Tech, an Israeli company, is accused of providing the infrastructure that connects commercial spyware makers to ad networks, effectively allowing precise targeting of individuals or organisations.

Key Perspectives

Citizen Lab researchers: They warn that this technique lowers the barrier for governments to conduct highly targeted surveillance, as ad networks offer global reach and granular targeting capabilities. Spyware makers (Candiru and Bindecy): These companies supply surveillance products to governments. Using ad networks allows them to infect devices without relying on phishing or other user-triggered methods. Privacy advocates: They are likely to argue that the lack of transparency in online advertising systems creates a vulnerability that can be exploited by state-backed actors, putting pressure on ad platforms and regulators to tighten controls.

What to Watch

  • Whether Discover-Tech faces legal or regulatory action from authorities in Israel or other jurisdictions.
  • Any disclosure from ad networks or tech platforms about steps they are taking to detect and block malicious ad campaigns used for spyware delivery.
  • Further investigations from Citizen Lab or other researchers into other spyware makers that may be using similar ad-based attack methods.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workSubscribe