Citizen Lab says governments are abusing online ads to hack people with ‘zero-click’ spyware

Your personal devices are now demonstrably vulnerable to government-backed spyware delivered invisibly through everyday online ads.

Citizen Lab researchers have discovered that governments are exploiting global advertising networks to deploy zero-click spyware, enabling them to hack targeted individuals or devices without any user interaction. The report details how an Israeli company, Discover-Tech, provides an advertising platform that acts as a conduit for spyware manufacturers like Candiru and Bindecy. These companies create surveillance products capable of infecting devices and stealing data silently. Citizen Lab found evidence of at least 45 Windows computers at Al Jazeera being compromised in 2024 and 2025 through Candiru's spyware, delivered via malicious online ads. While the specific governments behind these attacks remain unidentified, this marks the first documented instance of government-backed zero-click spyware being distributed through online advertisements, raising concerns about the widespread vulnerability of internet-connected devices.

This revelation signifies a critical escalation in the use of malvertising, moving beyond typical ad fraud to sophisticated state-sponsored cyber intrusions. The abuse of ad networks, designed for legitimate targeting, by spyware makers like Candiru and Bindecy via platforms such as Discover-Tech's Controlium, demonstrates a potent, difficult-to-evade attack vector. The exposure of Discover-Tech's platform, including source code and login credentials, highlights potential systemic weaknesses in the ad-tech supply chain that attackers can leverage for widespread compromise.

The broad reach of online advertising means that almost any internet-connected device could be a potential target, including those within sensitive organizations like media outlets, governments, and critical infrastructure. This development challenges traditional ad-blocking strategies, as zero-click exploits bypass user interaction entirely. Individuals in high-risk categories or those concerned about privacy may need to adopt more aggressive defensive measures, such as disabling ad tracking or employing more comprehensive ad-blocking solutions across all their devices.