Citizen Lab, the research group at the University of Toronto, has published the first technical evidence that commercial spyware was delivered to victims through ordinary online advertising. The target doesn't have to open a message or tap a link. Being shown the malicious ad is enough.
How it works
The report centers on Discover-Tech, an Israeli ad company. Its platform, Controlium, allegedly sat between ad networks and spyware makers such as Candiru and Bindecy. An operator picked a person or a device, and the malicious code reached them mixed in with regular ads. The dashboard's source code was exposed on its own login pages, which let researchers rebuild it.
The scale
At least 45 Windows computers at Al Jazeera were compromised in 2024 and 2025 after being shown malicious ads. Between March and June 2026, Discover-Tech ads ran across tens of thousands of apps and sites, including on devices used by militaries and government bodies. Whether those led to infections is unknown. Working with Confiant, researchers also spotted suspicious ads on networks tied to the IAEA and the International Criminal Court. The governments behind the attacks haven't been identified.
What to do
People who could be targeted because of their work are advised to turn off ad tracking or block ads altogether. Citizen Lab thinks Discover-Tech is probably just one piece of a bigger problem.