A Citizen Lab report details how spyware developers Candiru and Bindecy abused global advertising networks via Discover-Tech's Controlium platform.
Researchers uncovered exposed login credentials and billions of accessible ad bidding records while documenting zero-click infections affecting computers at Al Jazeera.
At the center of the case is an Israeli company called Discover-Tech. The company's platform, known as Controlium, acted as a bridge between advertising companies and the surveillance software industry, allowing them to target specific individuals.
How ads were used for spying
At least two spyware companies, Candiru and Bindecy, have used Discover-Tech's platform to target individuals. The programs can infect a device without the victim having to open a message or click on a link.
The researchers were able to track down the activity because Discover-Tech had left exposed files on its website. Without requiring a password, they were able to download user login files containing employee information from Candiru and Bindecy. They also found billions of ad files that showed ads were being served on tens of thousands of apps and websites between March and June 2026.
READ ALSO
Yandex problems didn't stop automated programs, according to Cloudflare
Who was affected?
The most specific confirmation concerns at least 45 computers at the offices of the Al Jazeera news organization, which were infected in 2024 and 2025 with the Candiru spyware program through online advertising. According to Citizen Lab, this is the first confirmed case of surveillance attacks by state agencies delivered through advertising.
Additionally, the platform’s records showed that ads appeared on devices used by military forces, governments, critical infrastructure and national technology agencies, although it has not been confirmed whether these displays ultimately led to an infection. Similar detections were also made on devices connected to the networks of the International Atomic Energy Agency and the International Criminal Court, according to researchers at ad quality assurance firm Confiant.
Al Jazeera, Discover-Tech and Integrity Labs, a company linked to Candiru, did not respond to requests for comment.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)