// TECHCRUNCH — CYBERSECURITY
Citizen Lab says governments are abusing online ads to hack people with ‘zero-click’ spyware
Security researchers at digital rights unit Citizen Lab say government spyware makers are abusing global advertising networks to target and hack devices by serving malicious online adverts.
A new report published Thursday by the University of Toronto lab, which investigates surveillance and digital rights abuses, said an Israeli company called Discover-Tech allows spyware makers to use its advertising platform to target specific people or devices almost anywhere in the world with spyware capable of invisibly stealing their data.
The researchers say Discover-Tech presents itself as a legitimate advertising firm, but instead serves as a “bridge between ad vendors and the mercenary spyware ecosystem.”
Citizen Lab said at least two makers of zero-click spyware, Candiru and Bindecy, used Discover-Tech’s platform to target people. Both of these spyware makers provide surveillance products that can infect devices without the victim having to open a message or click on a link.
The researchers found that one attack affected at least 45 Windows computers at media organization Al Jazeera. The devices were apparently hacked in 2024 and 2025 via Candiru’s spyware after being exposed to online ads packed with malicious code.
Citizen Lab said it wasn’t clear which governments were behind the attacks, but said this is the first confirmation of zero-click government-backed spyware attacks being delivered through online ads, potentially putting a vast number of devices around the world at risk of being targeted and hacked.
“There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action,” said Bill Marczak, a Citizen Lab senior researcher, ahead of the report’s release.
Hackers have long sought ways to abuse access to advertising networks, in part because of their ability to reach almost any internet-connected device in the world. Ad networks are designed to help advertisers target certain kinds of people, devices, and organizations with specific ads, but they can also be abused to target specific individuals or devices with malicious code.
While such so-called “malvertising” attacks are not new, using online ads to allow powerful government spyware to silently hack into devices is a notable escalation.
Security and privacy experts have for years encouraged people to install ad-blockers to prevent ads from being displayed on desktop and mobile screens, including within apps. But the ubiquity of online advertising makes it difficult to escape the industry’s clutches entirely.