Security researchers at the University of Toronto’s Citizen Lab have identified a new method used by government-backed spyware makers to infect devices. The technique involves abusing global online advertising networks to deliver malicious code directly to users’ screens. This approach allows attackers to compromise devices without requiring the victim to click a link or open a file.
Discover-Tech Platform Exposed
The investigation centers on an Israeli firm called Discover-Tech, which operates an advertising platform named Controlium. According to the report, the company presents itself as a legitimate advertising vendor but serves as a bridge between ad networks and the mercenary spyware industry. The platform enables spyware developers to target specific individuals or devices anywhere in the world.
Citizen Lab researchers found that at least two spyware providers, Candiru and Bindecy, utilized Discover-Tech’s infrastructure. These tools are designed to execute zero-click exploits, meaning they can install surveillance software the moment a device loads a malicious advertisement. The researchers noted that this represents the first concrete technical evidence of such attacks being delivered through standard online ad channels.
Bill Marczak, a senior researcher at Citizen Lab, stated that while there has been speculation about the ability to hack targets via ads, this report provides the first proof of the process in action. He described the findings as a significant escalation in the capabilities of government surveillance tools.
Al Jazeera and Global Targets Hit
The report details a specific incident involving the media organization Al Jazeera. Researchers traced an attack that compromised at least 45 Windows computers at the network. The devices were infected in 2024 and 2025 using Candiru spyware delivered through malicious ads. The investigation could not determine which government was behind the specific Al Jazeera attacks, but the method highlights the broad reach of the technology.
Further analysis of Discover-Tech’s exposed data revealed that its ads were displayed on devices used by militaries, governments, and critical infrastructure entities. The bidding records, which were left publicly accessible on the company’s website, showed ad impressions across tens of thousands of mobile apps and websites between March and June 2026. Security experts from the ad quality platform Confiant, who assisted in the investigation, found similar malicious ads appearing on networks belonging to the International Atomic Energy Agency and the International Criminal Court.
While the data confirms that the ads were served to these high-value targets, the researchers noted it remains unclear if the ads resulted in successful infections on all devices. The sheer volume of exposed bidding records suggests a widespread distribution network that could potentially reach a vast number of users globally.
Security Risks and Recommendations
The investigation also uncovered significant security failures on the part of Discover-Tech. The company’s web-based control panel dashboard contained exposed source code, allowing researchers to recreate the interface without logging in. Additionally, a public portion of the site allowed the download of user login records for the Controlium dashboard. These records included credentials for at least two employees of Candiru and some from Bindecy.
The exposure of these login details and the underlying infrastructure raises concerns about the operational security of the spyware industry itself. The researchers emphasized that the ubiquity of online advertising makes it difficult for users to avoid these threats entirely, as ad networks are designed to reach almost any internet-connected device.
Citizen Lab has urged individuals who might be targeted based on their profession or activities to take defensive measures. Marczak recommended disabling ad tracking on devices or blocking ads altogether to reduce the risk of exposure. He described Discover-Tech as likely just the tip of the iceberg, suggesting that other similar platforms may exist within the spyware ecosystem.
Al Jazeera, Discover-Tech, and Integrity Labs, the maker of Candiru, did not respond to requests for comment regarding the findings. The report serves as a stark reminder of how commercial advertising infrastructure can be weaponized for state-sponsored surveillance.
Source: TechCrunch
