Israeli spyware targeted 'hundreds of millions' through zero-click ads, researchers find
Millions of people's devices have been infected with Israeli mercenary spyware called Candiru through zero-click digital advertisements, Canadian cyber watchdog group The Citizen Lab found in an investigation.
The case marks the first-ever zero-click mercenary spyware, confirmed publicly, delivered through targeted ads, the group said in a report published on Thursday. The spyware also targeted devices linked to Al Jazeera Media Network.
Discover-Tech, an Israeli company that presents itself as a legitimate ad company but in reality operates for Israeli mercenary spyware partners like Candiru, placed targeted ads that directed millions of devices in dozens of countries to contact Candiru's servers for tracking and reconnaissance, according to the report.
The Citizen Lab found that in 2024 and 2025, at least 45 devices within Al Jazeera were targeted in a series of zero-click ad attacks purchased by Discover-Tech.
Discover-Tech controls a platform called Controlium that allows "mercenary partners to de-anonymize, fingerprint, and automatically infect devices" as soon as the ad is shown, without having the target even click on it.
New MEE newsletter: Jerusalem Dispatch
Sign up to get the latest insights and analysis on Israel-Palestine, alongside Turkey Unpacked and other MEE newsletters
During a four-month period, Discover-Tech's ads were shown on almost 200,000 unique websites and Android/iOS apps in dozens of countries.
Aside from Candiru, rebranded as Integrity Labs, Discover-Tech is also linked to other mercenary spyware actors, including Intelos and Bindecy.
'A systemic security threat'
Candiru was blacklisted by the US government in 2021 for "engaging in activities contrary to the national security or foreign policy interests of the United States". Candiru's rebrand came after it was acquired by US private equity firm Integrity Partners in 2025, which is not sanctioned by the US.
Discover-Tech has appeared as a "certified and "approved" vendor operated by Google and the advertising industry association IAB Europe, and has placed ads in major networks including Google, the Russian search engine Yandex and the platform Beeswax.
"The way online advertising works today is a systemic security threat," Wolfie Cristl, a senior researcher at The Citizen Lab, told Reuters. "For states, the private sector, civil society and everyone else alike."
Jerome Dangu, cofounder of the New York advertising security firm Confiant, which also published a separate report on the case on Thursday, said that Discover-Tech was placing at least 10 million ads per day worldwide and that data-sharing arrangements - called cookie matching - allowed it to track people even beyond its advertisements' reach.
"Very likely hundreds of millions of people would have been touched by Discover-Tech," Dangu said.
Dangu added that the ads had been shown to users in "hundreds of networks in sensitive categories," including the Pentagon, the International Atomic Energy Agency, and the International Criminal Court.
The Citizen Lab said it had also found Discover-Tech ad impressions in Nato and United Nations networks, as well as the European Parliament, European Commission and more than a dozen national governments.
Ads also appeared in media organizations in eight countries including Australia, Mexico and Europe.
Israeli spyware firm NSO Group was also added to the US trade blacklist, along with Candiru, in November 2021, after the US concluded that foreign governments had bought its spyware and used it to target government officials, journalists, and others.
Candiru was also used to target Middle East Eye and other websites in November 2021.
The attack, discovered by online security firm ESET, targeted MEE's website during two days in April 2020. The campaign targeted 20 other websites in two waves: April to July 2020 and January to August 2021.
ESET said that the targets had "links to the Middle East and a strong focus on Yemen and the surrounding conflict".
Following findings by the two research groups, Google, IAB Europe, Beeswax, and other platforms have since disconnected Discover-Tech's access to the digital advertising market.
Middle East Eye delivers independent and unrivalled coverage and analysis of the Middle East, North Africa and beyond. To learn more about republishing this content and the associated fees, please fill out this form. More about MEE can be found here.
