Governments are hacking people with ‘zero-click’ spyware by showing them online ads

Online advertisements now carry spyware that can infect your device without any action on your part.

Governments are now hacking individuals using 'zero-click' spyware delivered through online advertisements, according to a new report from The Citizen Lab. The University of Toronto research unit found that an Israeli company named Discover-Tech operates an advertising platform that serves as a conduit for spyware makers like Candiru and Bindecy to target and infect devices globally. These spyware products can steal data without any user interaction, such as clicking a link or opening a message. The report details an incident where at least 45 Windows computers at Al Jazeera were compromised in 2024 and 2025 through Candiru's spyware via malicious ads. While the specific governments involved remain unidentified, this marks the first confirmed instance of zero-click government-backed spyware being distributed through advertisements, posing a significant risk to numerous devices worldwide. Discover-Tech's platform, Controlium, had exposed source code and user login records, revealing its design to push malicious content alongside advertisements.

This method of spyware delivery through malvertising represents a significant escalation in surveillance capabilities, leveraging the pervasive nature of online advertising networks to reach targeted individuals or devices with precision. The involvement of companies like Discover-Tech, acting as an intermediary for mercenary spyware operations, blurs the lines between legitimate advertising and covert state-sponsored hacking, making detection and defense increasingly challenging. The potential reach of these attacks, demonstrated by ads appearing on networks for critical infrastructure and international agencies, suggests a broad and indiscriminate threat landscape for internet users.

The discovery underscores the evolving tactics of state-sponsored surveillance, moving beyond traditional phishing or direct exploits to weaponize everyday online experiences. For individuals and organizations, this necessitates a re-evaluation of digital security practices, with a stronger emphasis on mitigating ad-based threats. While ad blockers offer some protection, the ubiquity and integration of advertising across platforms mean that even seemingly benign online activities could inadvertently expose users to sophisticated zero-click exploits.