Citizen Lab Links Discover-Tech Ads to Zero-Click Spyware Hacks
Citizen Lab links Discover-Tech's ad platform to zero-click spyware attacks on 45 Al Jazeera PCs and exposure across thousands of apps and sites worldwide.
Summary
Citizen Lab, the University of Toronto digital rights laboratory, said Thursday, October 15, 2026, that Israeli company Discover-Tech presents itself as an advertising firm while its Controlium platform connects ad vendors with mercenary spyware makers. Candiru and Bindecy allegedly used it to target devices with zero-click spyware. Candiru software apparently compromised at least 45 Windows computers at Al Jazeera during 2024 and 2025 through malicious advertisements. The responsible governments remain unidentified, but Citizen Lab calls this the first technically confirmed delivery of government-backed zero-click spyware through online ads.
Exposed Controlium source code let researchers reconstruct its control panel, which appeared built to send malicious content with advertisements to individual users. Publicly accessible, password-free records included logins belonging to at least two Candiru employees and Bindecy users. Billions of exposed bidding records showed ads reaching tens of thousands of apps and websites from March to June 2026, including devices used by militaries, governments, critical infrastructure and national cyber agencies. Confiant also found potentially malicious ads on networks belonging to the International Atomic Energy Agency and International Criminal Court, although infections were not confirmed.
Citizen Lab senior researcher Bill Marczak called Discover-Tech the likely tip of the iceberg and advised potential targets to disable ad tracking or block ads. Advertising networks can reach almost any connected device, while ubiquitous ads remain difficult to avoid. Al Jazeera and Discover-Tech did not respond, and Candiru owner Integrity Labs could not be reached.
Positives
- Citizen Lab produced the first concrete technical evidence that online ads can deliver government-backed zero-click spyware.
- Exposed Controlium source code enabled researchers to reconstruct the platform’s web control panel without logging in.
- Billions of bidding records revealed where Discover-Tech advertisements appeared between March and June 2026.
- Disabling ad tracking or blocking advertisements gives potential targets an immediate defensive measure.
Risks & concerns
- At least 45 Al Jazeera Windows computers were apparently compromised by Candiru spyware during 2024 and 2025.
- Candiru and Bindecy could infect targeted devices without victims opening messages or clicking links.
- Discover-Tech advertisements reached devices used by militaries, governments, critical infrastructure and national cyber agencies.
- Potentially malicious ads appeared on International Atomic Energy Agency and International Criminal Court networks, although infections remain unconfirmed.
- The governments responsible remain unidentified, while global advertising networks can reach almost any internet-connected device.