Israeli spyware targeted 'hundreds of millions' through zero-click ads, researchers find

The case marks the first-ever zero-click mercenary spyware, confirmed publicly, delivered through targeted ads, the group said in a report published on Thursday. The spyware also targeted devices linked to Al Jazeera Media Network.

Discover-Tech, an Israeli company that presents itself as a legitimate ad company but in reality operates for Israeli mercenary spyware partners like Candiru, placed targeted ads that directed millions of devices in dozens of countries to Candiru's servers for tracking and reconnaissance, according to the report.

The Citizen Lab found that in 2024 and 2025, at least 45 devices within Al Jazeera were targeted in a series of zero-click ad attacks purchased by Discover-Tech.

Discover-Tech controls a platform called Controlium that allows "mercenary partners to de-anonymize, fingerprint, and automatically infect devices" as soon as the ad is shown, without having the target even click on it.

New MEE : Jerusalem Dispatch

During a four-month period, Discover-Tech's ads were shown on almost 200,000 unique websites and Android/iOS apps in dozens of countries.

Aside from Candiru, rebranded as Integrity Labs, Discover-Tech is also linked to other mercenary spyware actors, including Intelos and Bindecy.

'A systemic security threat'

Candiru was blacklisted by the US government in 2021 for "engaging in activities contrary to the national security or foreign policy interests of the United States". Candiru's rebrand came after it was acquired by US private equity firm Integrity Partners in 2025, which is not sanctioned by the US.

Discover-Tech has appeared as a "certified and "approved" vendor operated by Google and the advertising industry association IAB Europe, and has placed ads in major networks including Google, the Russian engine Yandex and the platform Beeswax.

"The way online advertising works today is a systemic security threat," Wolfie Cristl, a senior researcher at The Citizen Lab, told Reuters. "For states, the private sector, civil society and everyone else alike."

"Very likely hundreds of millions of people would have been touched by Discover-Tech," Dangu said.

Israeli spyware firm NSO Group was also added to the US trade blacklist, along with Candiru, in November 2021, after the US concluded that foreign governments had bought its spyware and used it to target government officials, journalists, and others.

Candiru was also used to target Middle East Eye and other websites in November 2021.

The attack, discovered by online security firm ESET, targeted MEE's website during two days in April 2020. The campaign targeted 20 other websites in two waves: April to July 2020 and January to August 2021.

ESET said that the targets had "links to the Middle East and a strong focus on Yemen and the surrounding conflict".

Following findings by the two research groups, Google, IAB Europe, Beeswax, and other platforms have since disconnected Discover-Tech's access to the digital advertising market.