Digital rights researchers from The Citizen Lab have uncovered a new, highly dangerous form of cyberattack in which spyware manufacturers exploit global advertising networks to secretly compromise phones around the world by displaying malicious online advertisements.
A new report from the University of Toronto's research laboratory reveals that the Israeli company Discover-Tech allows spyware developers to use its advertising platform to precisely target individuals and institutions.
Researchers point out that Discover-Tech publicly presents itself as a legitimate marketing platform, but in reality serves as a "bridge between advertising vendors and the mercenary spyware ecosystem."
According to Citizen Lab's findings, the platform has been used by at least two known manufacturers of so-called zero-click spyware — Candiru and Bindecy. These surveillance tools can infect devices without any interaction from the victim. There is no need to click on a suspicious link or open a message — simply loading an advertisement on a visited website or within an application is enough.
One of the most concrete examples cited is an attack on the media organization Al Jazeera, where at least 45 Windows computers were infected during 2024 and 2025 using Candiru's software after the devices were exposed to advertisements containing malicious code.
Although researchers have not specified which governments were behind these operations, this represents the first technically confirmed use of online advertising networks to distribute government spyware without requiring a click.
Researchers obtained key evidence thanks to security flaws in Discover-Tech's own platform, called Controlium.
The platform's website had exposed source code and publicly accessible system components that made it possible to download a user database without entering a password.
Login records included accounts belonging to employees of Candiru and Bindecy. Researchers also analyzed billions of advertising auction records showing that the advertisements in question appeared across tens of thousands of mobile applications and websites between March and June 2026.
In cooperation with advertising security company Confiant, researchers determined that these advertisements appeared on networks used by military institutions, government agencies, national cybersecurity agencies, and organizations such as the International Atomic Energy Agency (IAEA) and the International Criminal Court (ICC).
It remains unknown whether these advertising exposures resulted in successful device infections.
Discussion(0)