Spyware Makers Hijack Ad Networks for Zero-Click Hacks

Government-backed spyware operators have weaponized the global digital advertising ecosystem to silently infect devices, marking the first confirmed use of zero-click exploits delivered through online ads. The technique transforms a multi-billion-dollar industry designed to reach consumers into an indiscriminate surveillance delivery mechanism capable of targeting specific individuals or entire organizations without any interaction from the victim.

Researchers at the University of Toronto’s Citizen Lab, working alongside ad-security firm Confiant, identified Israeli company Discover-Tech as the central infrastructure provider enabling these attacks. Operating a platform called Controlium, Discover-Tech functions as a conduit between commercial ad exchanges and mercenary spyware developers. At least two known purveyors of government-grade surveillance tools — Candiru and Bindecy — utilized the platform to push malicious code disguised as standard advertisements.

Unlike traditional malvertising, which typically relies on tricking users into clicking deceptive banners or downloading fake software updates, this method leverages zero-click capabilities. The underlying spyware can compromise a device simply by loading an advertisement in a web browser or mobile app. This represents a severe escalation in threat severity, as victims have no opportunity to avoid infection through cautious browsing habits.

The operational impact is already documented. Citizen Lab confirmed that at least 45 Windows computers belonging to Al Jazeera journalists were compromised via Candiru spyware delivered through malicious ads throughout 2024 and 2025. While the researchers could not definitively attribute the campaign to a specific purchasing government, state-sponsored actors are the exclusive clientele for firms like Candiru, which was previously sanctioned by the U.S. Commerce Department in 2021 and added to the Entity List for facilitating human rights abuses.

Discover-Tech’s own security failures exposed the scale of its operations. Unprotected source code on Controlium’s login pages allowed researchers to reconstruct the platform’s dashboard, revealing an interface explicitly engineered to inject malicious payloads alongside legitimate advertisements for targeted users. Furthermore, publicly accessible, unauthenticated directories contained billions of programmatic ad bidding records generated between March and June 2026.

These bidding logs demonstrate that the tainted ads were served across tens of thousands of websites and mobile applications globally. Programmatic advertising operates through real-time auctions where ad space is bought and sold in milliseconds. Spyware vendors exploiting this architecture can bid on ad inventory specifically when a target’s IP address or device fingerprint enters the auction, ensuring the malicious payload is delivered only to the intended mark while appearing invisible to others.

The exposed records indicate that potentially malicious advertisements reached networks operated by militaries, national cyber agencies, critical infrastructure providers, the International Atomic Energy Agency, and the International Criminal Court. Confiant corroborated the presence of suspicious ads on these high-value institutional networks, though it remains unconfirmed whether the mere display of these ads resulted in successful compromises in every instance.

Standard consumer defenses against tracking offer limited protection against zero-click ad-based exploits. Privacy experts have long recommended ad-blockers and disabling cross-app tracking, but the deep integration of programmatic advertising into modern web and app infrastructure makes complete avoidance difficult. The discovery suggests that anyone operating in a high-risk profession — including journalism, diplomacy, legal advocacy, or government service — faces exposure simply by using internet-connected devices with standard configurations.

Bindecy, one of the spyware makers linked to the Controlium platform, emerged publicly earlier this year following investigations by European lawmakers and cybersecurity journalists who traced its operations to former intelligence officials. Its inclusion alongside Candiru indicates that multiple competing surveillance vendors are converging on advertising networks as a preferred infection vector.

Neither Discover-Tech nor Integrity Labs, the corporate entity behind Candiru, responded to inquiries regarding the findings. Al Jazeera also did not provide comment on the confirmed breaches of its newsroom infrastructure. Citizen Lab senior researcher Bill Marczak characterized Discover-Tech’s operation as a fraction of a broader, undocumented market facilitating ad-network exploitation by state hackers.

Confiant has begun sharing indicators of compromise associated with the Controlium platform with major ad exchanges and supply-side platforms to disrupt the ongoing campaigns.