A new report from the University of Toronto’s Citizen Lab reveals that government-backed spyware operators are leveraging global advertising networks to deliver zero-click malware through online ads. The researchers identified Israeli firm Discover-Tech, which markets itself as an advertising platform but functions as a conduit for malicious actors. Its system, named Controlium, was found to enable spyware developers to embed malicious code within standard ad placements, allowing silent infection of devices without user interaction.

Evidence shows that at least two zero-click spyware vendors, Candiru and Bindecy, used Discover-Tech’s infrastructure to target individuals and organizations. One incident compromised 45 Windows systems at Al Jazeera, with infections traced to malicious ads served between 2024 and 2025. The malware used, attributed to Candiru, can bypass standard user engagement requirements, making detection difficult.

Analysis of publicly accessible data from Discover-Tech’s platform exposed login records tied to employees of spyware firms, including Candiru and Bindecy. Additional records revealed billions of ad impressions served across thousands of websites and mobile applications between March and June 2026. These ads appeared on networks used by military units, government agencies, and international institutions, including the International Atomic Energy Agency and the International Criminal Court.

While direct confirmation of infections at these organizations remains unverified, security researchers collaborating with Citizen Lab detected malicious ad content in their environments. The findings mark the first confirmed use of ad networks to deliver state-linked zero-click exploits, a method that could affect millions of devices globally.

Citizen Lab researcher Bill Marczak emphasized the significance: “This is the first technical confirmation that zero-click government spyware is being deployed via online ads. The scale and precision of these attacks suggest systemic risks.”

The report notes that Discover-Tech’s exposed source code and unsecured login portals allowed researchers to map its operations. Ad bidding data showed targeted delivery to high-value networks, though the full scope of compromises remains unclear. Experts warn that ad-blocking tools may offer limited protection due to the pervasive nature of digital advertising ecosystems.

Zack Whittaker, TechCrunch’s security editor, reported on the findings. He can be contacted via encrypted messaging at zackwhittaker.1337 on Signal or at [email protected].

The investigation underscores growing concerns about the intersection of commercial advertising infrastructure and state-sponsored cyber operations. As ad networks continue to expand their reach, the potential for exploitation by malicious actors increases, prompting calls for heightened scrutiny and defensive measures.