Bill Marczak, a senior researcher at the University of Toronto’s Citizen Lab, says the lab now has “concrete technical evidence” that government spyware has been delivered through ordinary online advertising, a process he described as documented for the first time. The delivery method needs no tap, no download and no suspicious message: a targeted ad that merely renders on a device can be enough to start an infection.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.
We may earn a commission if you sign up.
The lab traced the pipeline to an Israeli company called Discover-Tech, which presents itself as a legitimate advertising firm. Its ad platform, known as Controlium, sat between the buyers and sellers of ad space and the makers of mercenary spyware, and the two spyware vendors Citizen Lab names as partners are Candiru and Bindecy.
Discover-Tech and the Controlium ad platform
Citizen Lab’s report, published Thursday, Oct. 15, calls the technique AdFection and describes how it works in five steps. Discover-Tech wins an ad auction, and its ad loads on a phone or computer, often without the user noticing it. A script tag inside the ad contacts a Discover-Tech server and passes along the device’s advertising identifier and IP address. That server then decides whether to return malicious JavaScript or an empty response, which lets Discover-Tech avoid handing ad partners any malicious code or even pointers to it.
For people the customers wanted, the sequence continued to a Candiru check server, then profiling of the device, then infection, then contact with a Candiru command-and-control server. Citizen Lab wrote that “the simple display of a targeted ad is enough for infection,” and called the finding the first public confirmation of zero-click mercenary spyware delivered through targeted ads.
The lab also described Discover-Tech as a facilitator for several spyware partners rather than a single vendor’s tool. Besides Candiru and Bindecy, the report links the company to a third surveillance firm, Intelos, which makes a product called AD/HOC.
Al Jazeera and the scale of the ad inventory
TechCrunch reported that at least 45 Windows computers at Al Jazeera were apparently compromised in 2024 and 2025 with Candiru spyware after being exposed to malicious ads. Citizen Lab said it is unclear which governments were behind the attacks, and Al Jazeera and Discover-Tech did not respond to requests for comment. Candiru’s maker, now called Integrity Labs, could not be reached.
The researchers got a look inside the operation because Controlium’s source code was exposed on login pages, which let them recreate its control panel, and part of the public site let them download user login records without a password. Those records included two Candiru employees and some Bindecy users. The same exposure revealed about four billion ad bidding records, which Citizen Lab analyzed to show Discover-Tech ads appearing on nearly 200,000 apps and websites in dozens of countries over roughly four months.
Within that data, the report counted 75,373 apps and 120,768 websites, covering bids from March through June 2026. TechCrunch’s account puts the same reach as tens of thousands of mobile apps and websites, on devices used by militaries, governments, critical infrastructure operators and national cyber agencies. Neither source says whether those particular ads caused any compromises.
Confiant’s separate look at the ad traffic
Ad-quality firm Confiant, which worked alongside Citizen Lab, published its own analysis the same day and found evidence of potentially malicious ads on the networks of the International Atomic Energy Agency and the International Criminal Court. Confiant called the operator sophisticated by malvertising standards, citing an encrypted command channel and several ways to move data. It stopped short of claiming a full exploit chain captured in the wild.
Confiant’s estimate was roughly 10 million ad impressions a day, and its reading of the data was that the passive collection could feed an identity graph that spyware buyers use to pick targets. In its words, the operation amounts to “passive surveillance on a global scale.” Citizen Lab reported that Google and IAB Europe removed Discover-Tech from their registries in early October 2026, and that Beeswax, Vungle and Eskimi also took action.
Ad blockers and what Citizen Lab recommends
Marczak called Discover-Tech “surely just the tip of the iceberg” and advised anyone who might be a target to turn off ad tracking on their devices. Citizen Lab’s wider advice, as TechCrunch relayed it, includes blocking ads altogether. That recommendation has a history: security experts have long urged ad blockers against malvertising, and TechCrunch noted in 2024 that the FBI recommended them in a 2022 public service announcement.
Blocking is harder on phones than in a browser, because ads load inside apps. One tool aimed at that gap is Filtr, an add-on to the Wipr Safari blocker that filters ads inside iPhone, iPad and Mac apps using Apple’s URL filters, though it usually cannot stop ads served from an app’s own domain. Citizen Lab’s report itself calls for regulators to investigate whether Discover-Tech and Candiru broke applicable laws.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
Tech news in one quick read: Subscribe to TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- The NSA says three phone features should be off whenever you aren’t using them
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
- Tropical Storm Rachel is dumping up to 12 inches on four Mexican states on its way to major hurricane strength
- The FTC says Lens.com doubled the price shoppers saw in Google ads
