Key facts
- Governments are using online advertising networks to deliver zero-click spyware.
- Discover-Tech's platform, Controlium, is allegedly used to target devices with spyware.
- Candiru and Bindecy are named as makers of zero-click spyware that used Discover-Tech's platform.
- At least 45 Al Jazeera Windows computers were hacked in 2024 and 2025 via Candiru's spyware.
- Discover-Tech's platform had exposed source code and user login records.
- Malicious ads were displayed across tens of thousands of apps and websites between March and June 2026.
Governments are leveraging global advertising networks to deploy zero-click spyware, enabling them to hack devices and steal data invisibly, according to a report by Citizen Lab. The University of Toronto lab's research highlights Discover-Tech, an Israeli company, as a facilitator that allows spyware makers to target specific individuals or devices worldwide.
Citizen Lab identified Candiru and Bindecy as two spyware makers that utilized Discover-Tech's platform. These companies provide surveillance products capable of infecting devices without any user interaction, such as clicking a link. The report details an incident where at least 45 Windows computers at Al Jazeera were compromised in 2024 and 2025 through Candiru's spyware delivered via malicious online ads.
Researchers discovered that Discover-Tech's platform, named Controlium, had exposed source code and user login records, some belonging to employees of Candiru and Bindecy. Billions of ad bidding records indicated that these malicious ads were displayed across tens of thousands of mobile apps and websites between March and June 2026, potentially reaching critical infrastructure and national cyber agencies. Evidence also suggested similar malicious ads appeared on networks of the International Atomic Energy Agency and the International Criminal Court.