What was found
Researchers at Citizen Lab, part of the University of Toronto, described a scheme in which malicious code is hidden inside online ads. No click is needed: it is enough for the ad to be shown on the targeted device. The report calls this the first confirmed case of spyware being delivered this way.
Who is behind it
The go-between was Discover-Tech, an Israeli company that runs an ad platform called Controlium. Spyware makers Candiru and Bindecy used it. Part of the platform's source code was exposed, so researchers could rebuild its control panel without logging in.
The scale
- At least 45 Windows computers at Al Jazeera were infected in 2024 and 2025.
- Between March and June 2026 the platform's ads appeared across tens of thousands of apps and websites, including on devices used by militaries, governments and critical infrastructure.
- Ad-quality firm Confiant found signs of suspicious ads on networks of the IAEA and the International Criminal Court.
What is still unknown
It is unclear which governments ordered the attacks, or whether every ad impression led to an infection. One of the report's authors believes Discover-Tech is just the tip of the iceberg.
What to do
People who may be targeted are advised to turn off ad tracking on their devices or block ads altogether.