Online advertising systems may have been used to deliver government-backed spyware without requiring a person to click a link or open a message, according to a report by the University of Toronto's Citizen Lab.
The researchers say Israeli company Discover-Tech's advertising platform, Controlium, enabled spyware operators to direct malicious ads toward selected people or devices. They identified two spyware firms, Candiru and Bindecy, as users of the platform.
Targeted ads and exposed records
Citizen Lab linked one campaign to at least 45 Windows computers at Al Jazeera. The devices were reportedly targeted in 2024 and 2025 with Candiru spyware delivered through ads containing malicious code. The researchers could not determine which governments, if any, were behind the activity.
The team also found that Controlium's web dashboard and user login records were accessible without authentication. Billions of advertising-bidding records indicated that ads appeared across tens of thousands of apps and websites between March and June 2026. Some ads were shown on devices connected to government, military and critical-infrastructure networks, though the records do not establish that those devices were compromised.
Citizen Lab described the findings as technical evidence that ad networks can be used to precisely deliver zero-click spyware. The research highlights how the broad reach of digital advertising could also create new security risks, while underscoring the importance of stronger safeguards and privacy controls. As ad systems evolve, their security will become increasingly central to protecting connected devices.
