Citizen Lab says governments are abusing online ads to hack people with ‘zero-click’ spyware
Citizen Lab says Candiru and Bindecy used Discover-Tech ads to deliver zero-click spyware, including against Al Jazeera.
Citizen Lab says Israeli firm Discover-Tech let mercenary spyware makers use its Controlium advertising platform to deliver malicious ads. At least Candiru and Bindecy used the platform, and Candiru’s zero-click spyware infected at least 45 Al Jazeera Windows computers in 2024 and 2025. Researchers recovered exposed dashboard code, login records, and billions of bidding records showing ads displayed across apps and sites from March to June 2026, including devices tied to militaries, governments, and critical infrastructure. Confiant also saw potentially malicious ads on International Atomic Energy Agency and International Criminal Court networks, though infection there is unconfirmed.