A laboratory at the University of Toronto that studies monitoring and digital rights abuses released a new report on Thursday, stating that an Israeli company named Discover-Tech allows spyware manufacturers to use its advertising platform to target specific individuals or devices anywhere in the world with spyware that can steal data without being detected.
Citizen Lab indicates that at least two "zero-click" spyware manufacturers, Candiru and Bindecy, have used Discover-Tech's platform to target their victims. Both companies offer monitoring products that are capable of infecting devices without the victims needing to open messages or click on links.
Researchers found that one of the attacks affected at least 45 computers belonging to the media organization Al Jazeera. These devices were clearly invaded in 2024 and 2025 through spyware from Candiru, by coming into contact with online advertisements containing malicious code.
Citizen Lab It is not yet clear which governments are behind these attacks, but it is stated that this is the first time a government-backed "zero-click" spyware attack has been confirmed to be delivered through online advertising, which may put a large number of devices around the world at risk of being locked and compromised.
Researchers say that the platform name of Discover-Tech is Controlium. The company claimed that a portion of its source code was exposed on the login page, allowing researchers to reconstruct its web-based control panel dashboard without the need to log in. The researchers noted that this web dashboard “seems to be specifically designed to push malicious content to individual target users alongside advertisements.”
It was also found that on the Discover-Tech website, a portion of the data was publicly accessible, allowing researchers to download a large amount of user login records from the Controlium dashboard without needing a password. Some of this login information belonged to employees of at least two spyware manufacturers, Candiru, as well as some employees of Bindecy.
The Marczak of Citizen Lab indicates that Discover-Tech is "surely just the tip of the iceberg," and urges people to take defensive measures.
Al Jazeera has not responded to requests for comments regarding these hacker attacks. Discover-Tech has also not responded, and Candiru's parent company, Integrity Labs, could not be contacted for a comment either.
