Citizen Lab says governments are abusing online ads to hack people with ‘zero-click’ spyware

Security researchers astatine integer rights portion Citizen Lab accidental authorities spyware makers are abusing planetary advertizing networks to people and hack devices by serving malicious online adverts.

A new study published Thursday by the University of Toronto lab, which investigates surveillance and integer rights abuses, said an Israeli institution called Discover-Tech allows spyware makers to usage its advertizing level to people circumstantial radical oregon devices astir anyplace successful the satellite with spyware susceptible of invisibly stealing their data.

The researchers accidental Discover-Tech presents itself arsenic a morganatic advertizing firm, but alternatively serves arsenic a “bridge betwixt advertisement vendors and the mercenary spyware ecosystem.”

Citizen Lab said astatine slightest 2 makers of zero-click spyware, Candiru and Bindecy, utilized Discover-Tech’s level to people people. Both of these spyware makers supply surveillance products that tin infect devices without the unfortunate having to unfastened a connection oregon click connected a link.

The researchers recovered that 1 onslaught affected astatine slightest 45 Windows computers astatine media enactment Al Jazeera. The devices were seemingly hacked successful 2024 and 2025 via Candiru’s spyware aft being exposed to online ads packed with malicious code.

Citizen Lab said it wasn’t wide which governments were down the attacks, but said this is the archetypal confirmation of zero-click government-backed spyware attacks being delivered done online ads, perchance putting a immense fig of devices astir the satellite astatine hazard of being targeted and hacked.

“There has been a batch of buzz that online ads tin beryllium utilized to place and automatically hack targets with pinpoint precision, but present for the archetypal time, we person factual method grounds showing this process successful action,” said Bill Marczak, a Citizen Lab elder researcher, up of the report’s release.

Hackers person agelong sought ways to maltreatment entree to advertizing networks, successful portion due to the fact that of their quality to scope astir immoderate internet-connected instrumentality successful the world. Ad networks are designed to assistance advertisers people definite kinds of people, devices, and organizations with circumstantial ads, but they tin besides beryllium abused to people circumstantial individuals oregon devices with malicious code.

While specified alleged “malvertising” attacks are not new, utilizing online ads to let almighty authorities spyware to silently hack into devices is simply a notable escalation.

Security and privateness experts person for years encouraged radical to instal ad-blockers to forestall ads from being displayed connected desktop and mobile screens, including wrong apps. But the ubiquity of online advertizing makes it hard to flight the industry’s clutches entirely.

Image Credits:Citizen Lab (screenshot)

The researchers said Discover-Tech’s platform, which the institution calls Controlium, near immoderate of its root codification exposed connected its login pages, allowing the researchers to recreate its web-based power sheet dashboard without needing to log in. The researchers accidental the web dashboard “appears to beryllium specifically designed to let them to propulsion malicious contented to idiosyncratic targeted users alongside advertisements.”

Citizen Lab besides recovered that Discover-Tech’s tract had a publically accessible information that allowed the researchers to download reams of idiosyncratic login records for the Controlium dashboard without needing a password. Some login details belonged to astatine slightest 2 employees of spyware shaper Candiru, arsenic good arsenic immoderate from Bindecy.

The researchers besides recovered billions of advertisement bidding records near exposed connected Discover-Tech’s website, which showed that its ads had yet been displayed crossed tens of thousands of mobile apps and websites betwixt March and June 2026.

The bidding records amusement that the ads were shown connected devices utilized by militaries, governments, captious infrastructure, and nationalist cyber agencies. However, it’s unclear if the displayed ads resulted successful a compromise oregon infection.

Security researchers with advertisement prime level Confiant, which worked with Citizen Lab to investigate, said they found evidence that perchance malicious ads were likewise shown connected devices connected the networks of the International Atomic Energy Agency, and the International Criminal Court.

Citizen Lab’s Marczak said Discover-Tech is “surely conscionable the extremity of the iceberg,” and urged radical to instrumentality antiaircraft action. 

“If you mightiness beryllium targeted based connected who you are oregon what you do, it’s clip to disable advertisement tracking connected your devices oregon adjacent artifact ads altogether,” said Marczak.

Al Jazeera did not respond to a petition for remark astir the hacks. Neither did Discover-Tech, and Candiru shaper Integrity Labs could not beryllium reached for comment.