Citizen Lab researchers have revealed that spyware vendors like Candiru and Bindecy are using digital advertising platforms to silently infect high-value devices. By exploiting real-time bidding, the attackers targeted institutions including Al Jazeera and the International Atomic Energy Agency without requiring user interaction. This discovery exposes a significant security vulnerability in the global online advertising ecosystem, posing risks to ad-tech integrity and user privacy.
Researchers at the University of Toronto’s Citizen Lab have uncovered a sophisticated cybersecurity threat where government-linked spyware vendors are using online advertising networks to deliver malicious code. The investigation identified an Israeli entity, Discover-Tech, as a central facilitator that bridged the gap between advertising vendors and the mercenary spyware industry. Through a platform called Controlium, the company allegedly allowed spyware creators such as Candiru and Bindecy to serve malicious payloads directly through digital ad platforms.
This method is particularly dangerous because it employs zero-click infections. Unlike traditional malware attacks that require a user to click a suspicious link or download a file, these malicious advertisements function silently in the background. This allows attackers to compromise devices without any interaction from the victim, making the breach extremely difficult to detect for the average user.
The reach of these attacks appears to be focused on high-value targets. Investigative findings confirmed that at least 45 Windows systems at the news organization Al Jazeera were compromised between 2024 and 2025. Furthermore, data analysis of Discover-Tech’s infrastructure, which included exposed dashboards and billions of bidding records, indicated that malicious ads were pushed to devices linked to military personnel, cyber defense agencies, and critical infrastructure operators. Collaborative research with ad quality firm Confiant also discovered that these potentially harmful advertisements appeared on the networks of global organizations, including the International Atomic Energy Agency and the International Criminal Court.
The security risk stems from the fundamental design of real-time bidding systems used in online advertising. These systems are designed to target specific device profiles with high precision, a feature that attackers are now weaponizing for intelligence gathering. The exposure of Discover-Tech’s internal infrastructure, including sensitive user logs and source code, suggests that these vulnerabilities may be easily replicated by other bad actors.
For the technology sector and advertising platforms, this discovery marks a concerning shift in surveillance tactics. Security experts warn that businesses relying on programmatic advertising may face increased pressure to strengthen their screening and security protocols. As the effectiveness of these attacks becomes more apparent, protective measures such as disabling personalized ad tracking and employing comprehensive ad-blocking have moved from optional privacy recommendations to critical defensive requirements for professionals handling sensitive information.