Citizen Lab links online ads to zero-click spyware attacks

Citizen Lab reported Thursday that spyware makers used Discover-Tech's advertising platform to target devices with malicious ads that can infect them without a click. Researchers linked Candiru spyware to attacks affecting at least 45 Windows computers at Al Jazeera in 2024 and 2025, describing the findings as the first confirmed delivery of government-backed zero-click spyware through online ads. Exposed platform code and login records connected the service to Candiru and Bindecy. Billions of exposed bidding records showed ads reaching tens of thousands of apps and websites between March and June 2026, including devices used by governments and critical infrastructure. Those ad impressions do not establish that the devices were compromised, and the governments behind the attacks remain unclear.