Governments Use Malicious Online Ads for Zero-Click Spyware Attacks
Left 33%
Center 33%
Right 33%
1 left · 1 center · 1 right
What happened
Security researchers at the University of Toronto’s Citizen Lab and ad-security firm Confiant reported that Israeli ad-tech company Discover-Tech ran a platform called Controlium that spyware vendors used to deliver zero-click spyware through targeted online ads, requiring no click or message from the victim. They said at least two spyware makers—Candiru (a U.S.-blacklisted Israeli firm also linked to Integrity Labs) and Bindecy—used the platform, and that Candiru-linked spyware infected at least 45 Windows computers at Qatar-based news network Al Jazeera in 2024 and 2025. Citizen Lab said it could not determine which governments commissioned the attacks. Google and Comcast-owned Beeswax later removed Discover-Tech from their ad platforms, and IAB Europe suspended the company from its approved-vendor list. Discover-Tech, Al Jazeera, and Candiru’s parent did not comment in the reporting.
Sourcing check · Fully on the record · 3 articles
3 of 3 articles cite a named source for the story. It was on the record from the first report.
What these terms mean and how they're counted
- On the record · names a source 3 of 3
- On the record means the article cites a source by name for the story's main claim: a person, or an institution speaking officially, such as a company statement or a named agency's spokesperson. The opposite is an unnamed source. The count is how many of the counted articles cite at least one such source; the names are everyone named across them, each once however the articles spell it. Here: Citizen Lab and Confiant, Confiant, Citizen Lab and Bill Marczak
- Primary evidence · cites a document or data 2 of 3
- Primary evidence means the article cites a record you could check yourself: a court filing or ruling, a dataset or report, a recording or transcript, an official statement or press release, market data. A quote is not a document. The count is how many articles cite one. Here: report
- Credits another outlet 0 of 3
- The article says the story comes from another outlet's reporting (“first reported by Reuters”). Those articles relay the story; they are not independent confirmation. Here: Each article presents its own reporting.
- Unnamed sources 0 of 3
- The main claim is attributed to people who are not identified: “people familiar with the matter”, “officials said”. The count is how many articles do this.
- How it developed
- When the first report landed and whether it named anyone; when the first named source and the first document appeared. Here: First report Oct 15, 10:00 UTC by TechCrunch, naming its source. First document in the first report, from TechCrunch (report).
- Not counted 0
- Opinion, analysis and video pieces, and articles too short to assess. Every count above is out of the counted articles. An article republished under a new headline is one article.
This is about who is cited, not whether the story is true. Each source below says what it names. How we count
BLINDSPOT.
Only left-leaning outlets are covering this story
— the other side's media is silent.
Omitted — what each side leaves out
Unpacked
Right-leaning outlets had not covered this as of publication. Left-leaning coverage reports that Discover-Tech, an Israeli ad-tech firm, gave spyware makers a way to infect phones and computers by merely showing an ad, with no click required. It says Candiru-linked spyware hit Al Jazeera and that researchers counted 45 targeted devices there. That is described as the first technical evidence of zero-click government spyware arriving through advertising. A reader of the silent side misses that entire chain. The same left-leaning account does not name Bindecy as a second customer of the platform. It also does not report ads turning up on IAEA or International Criminal Court networks.
Left-leaning coverage leads with the Israeli vendor rather than with unknown government buyers. The story in The Verge is framed around Discover-Tech and notes that Google and Beeswax later removed the firm. It never states that researchers could not tell which governments ordered the hacks.
Who paid for the Al Jazeera infections, and did any ad shown to military or nuclear-watchdog devices actually compromise them?
Bottom line
If your news diet is right-leaning, you would not know researchers have documented zero-click spyware arriving through ordinary ads, including on 45 computers at Al Jazeera. The Verge reported that case and still never named Bindecy as a second firm on the same ad pipeline.
The receipts — 6 facts one side's coverage lacks
- Candiru-linked spyware delivered through Discover-Tech ads targeted at least 45 devices at Al Jazeera in 2024 and 2025
- At least two zero-click spyware makers, Candiru and Bindecy, used Discover-Tech's platform
- Potentially malicious ads were shown on devices on the networks of the International Atomic Energy Agency and the International Criminal Court
- Discover-Tech left Controlium login records downloadable without a password, including accounts of Candiru employees
- Exposed bidding records showed Discover-Tech ads on devices used by militaries, governments, critical infrastructure, and national cyber agencies
- Candiru has been blacklisted by the US government
The Left View
The Verge and TechCrunch, citing the Citizen Lab–Confiant investigation (The Verge also notes earlier NBC News reporting), present Discover-Tech as a firm that markets itself as a normal ad agency while serving as a bridge to mercenary spyware vendors. They report that Controlium could profile and de-anonymize users by IP address, mobile ad ID, or browser identifier and push malicious ads; that researchers rebuilt a targeting dashboard from exposed source code and obtained login records tied to Candiru and Bindecy employees; and that billions of exposed bidding records showed ads served across tens of thousands of apps and sites, including devices on military, government, IAEA, and International Criminal Court networks, without proof those impressions caused infections. Coverage treats the Al Jazeera cluster as the first technical evidence of government-grade zero-click spyware delivered via ads, quotes Citizen Lab’s Bill Marczak calling Discover-Tech “the tip of the iceberg,” and notes the subsequent platform bans plus advice that high-risk users block ads and disable tracking.
Our Take (balanced)
The story is substantive: it names companies, researchers, a victim organization, a device count and years, and points to checkable artifacts (exposed code, logins, bidding records) plus later removals by Google, Beeswax, and IAB Europe. Established is that Citizen Lab and Confiant found Discover-Tech’s Controlium used by spyware vendors and that Candiru-linked infections hit at least 45 Al Jazeera Windows PCs in 2024–2025; the platform bans are independently observable. Unconfirmed are which governments ordered the operations, whether ads seen on military, IAEA, or ICC networks produced infections, and Discover-Tech’s own account, because the company and the spyware makers have not responded. No right-leaning outlet has reported this. Watch for comments from Discover-Tech, Candiru/Integrity Labs, and Al Jazeera; any official attribution; independent technical corroboration; and further industry or regulator action.
3 sources
More stories
The week's bottom lines, in your inbox
One email a week: the five stories that mattered and what they actually mean. Free.