Researchers at Citizen Lab have identified that government-backed spyware developers are utilizing global advertising networks to distribute malicious code. The report highlights the role of an Israeli firm, Discover-Tech, which allegedly acts as a conduit between ad vendors and the mercenary spyware industry.
The investigation links two spyware providers, Candiru and Bindecy, to the use of Discover-Tech’s platform. These tools enable zero-click infections, meaning devices can be compromised without user interaction. One documented attack involved 45 Windows computers at Al Jazeera during 2024 and 2025.
Security experts discovered that Discover-Tech left sensitive data exposed, including login credentials for its Controlium dashboard and billions of ad bidding records. These records indicate that malicious ads were displayed across tens of thousands of websites and mobile applications between March and June 2026.
The exposed bidding data shows that ads were served to devices associated with national cyber agencies, militaries, and critical infrastructure. Additionally, researchers from Confiant found evidence of potentially malicious ads appearing on networks belonging to the International Atomic Energy Agency and the International Criminal Court.
