Governments are reportedly using global advertising networks to deliver “zero-click” spyware through malicious ads, according to a new report by digital rights organization Citizen Lab. The ad platform in question, operated by a firm called Discover-Tech, allegedly allows spyware makers to target individuals or devices anywhere in the world with malware that can infect systems without any user interaction. This method poses one of the most serious threats seen in adtech and surveillance to date.
Citizen Lab’s investigation uncovered that Discover-Tech presents itself as a standard advertising company but in reality functions as a bridge between legitimate ad vendors and spyware firms. Two known zero-click spyware creators, Candiru and Bindecy, are said to have used Discover-Tech to distribute malicious ads. These ads reportedly enabled Candiru to carry out attacks in 2024 and 2025 against at least 45 Windows machines at media organization Al Jazeera, injecting spyware via ad units without requiring victims to click or open messages.
Leaked infrastructure, bidding data, widespread risk
The probe also revealed glaring security lapses in Discover-Tech’s systems. Parts of its control dashboard, called Controlium, had exposed source code on its login pages, allowing researchers to recreate control panels without needing credentials. Likewise, login data for actual employees—including individuals tied to Candiru and Bindecy—were accessible publicly. Perhaps most notably, hundreds of millions of ad-bid logs were exposed, showing Discover-Tech ads were served across tens of thousands of mobile apps and websites between March and June 2026.
These bidding records indicate exposure even for high-risk networks—devices operated by national cyber agencies, critical infrastructure, militaries, and government institutions saw these ads. It remains unclear how many of these exposures resulted in actual infections. Organizations such as the International Atomic Energy Agency and the International Criminal Court are among those listed as having viewed these suspect ads.
What this means & what can be done
This isn’t just malvertising—it’s a major escalation. Zero-click spyware attacks are especially dangerous because they don’t require tricking victims into interacting; simply serving a malicious ad can be enough. That governments are using such tactics via advertising amplifies the scale and stealth of political or surveillance-driven hacking campaigns. Citizen Lab’s senior researcher calls Discover-Tech evidence “the tip of the iceberg.”
As for protection: researchers recommend disabling ad tracking and using ad-blockers, especially for people who may be high-risk targets due to profession or visibility. Given how pervasive online ads have become, avoiding all exposure may be impossible—but reducing it may lower the odds of becoming compromised.
Discover-Tech, Candiru, Bindecy and others named in the report did not respond to outreach for comment. Al Jazeera has not confirmed whether specific devices were breached beyond the report’s findings.
Zero-click spyware delivered via online ads suggests a dangerous new frontier, where surveillance tools move from targeted phishing and exploits into the world of programmatic ad delivery. Moving forward, digital rights defenders, adtech companies, and governments must reckon with these techniques’ erosion of both privacy and trust. Monitoring systems and legal frameworks designed for traditional hacking may struggle to keep up. This isn’t just about stopping bad ads—it’s about redefining what it means to be safe in a hyperconnected world.
