Researchers link government spyware delivery to online ad infrastructure

The finding shows spyware can arrive through ad systems, raising the risk for organisations whose staff or audiences were targeted online.

Citizen Lab and Confiant say an Israeli ad-tech company, Discover-Tech, used online advertising infrastructure to deliver zero-click spyware, marking the first technical confirmation of government-backed spyware arriving through ads. The researchers say the scheme targeted at least 45 devices at Al Jazeera in 2024 and 2025 through Candiru-linked payloads, and that Discover-Tech’s platform let partners profile targets using identifiers such as IP addresses and mobile ad IDs. They also found exposed records and dashboard data on Discover-Tech’s site, including login details tied to employees of spyware maker Candiru, and ad-bidding logs showing broad distribution across mobile apps and websites. Google has now blocked Discover-Tech from its ad platforms, while other industry groups and partners have also moved to cut off the company.