Spyware that gets in through an ordinary ad, without a single click: Citizen Lab points to Israel's Discover-Tech

The victim doesn't need to open or click anything: it's enough for an ad to appear on their screen. That's the conclusion of a new report by Citizen Lab, the digital rights unit at the University of Toronto, which says makers of government spyware are abusing global advertising networks to hack devices.

At the centre is Discover-Tech, an Israeli firm that presents itself as an advertising company. According to the researchers, its platform let spyware makers target specific people or devices almost anywhere in the world, with programs that infect a device without the victim opening a message or clicking a link. Candiru and Bindecy are named as users of the platform.

The most concrete case is Al Jazeera. At least 45 Windows computers at the media organisation were most likely hacked in 2024 and 2025 with Candiru spyware after malicious ads were shown on them.

The researchers also stumbled on exposed data: source code, login records, including those of Candiru employees, and billions of ad-bidding records. These show the ads ran across tens of thousands of apps and websites between March and June 2026, including on devices used by militaries, governments and critical infrastructure. Whether those ads ended in hacking isn't clear.

Confiant, a company that checks ad quality and worked with Citizen Lab, found traces of potentially malicious ads on the networks of the International Atomic Energy Agency and the International Criminal Court too. If an ad can reach the network of the court for war crimes, where can't it reach?

Citizen Lab couldn't establish which governments are behind the attacks. Bill Marczak, a senior researcher at the lab, says there is "concrete technical evidence" that the process works in practice, and that Discover-Tech is "surely just the tip of the iceberg". His advice to people who may be targets is to turn off ad tracking or block ads entirely. Al Jazeera and Discover-Tech didn't respond to requests for comment, and Integrity Labs, the company behind Candiru, couldn't be reached.

Macedonia remembers what it means when someone listens in on other people's conversations on a mass scale - the wiretapping scandal defined an entire political cycle. Today you don't even need a wire or a contact inside the security services; an ad budget will do. Who controls who buys such ads and who they're shown to?