Threats · 7h ago
Citizen Lab says Discover-Tech’s ad platform was used to deliver zero-click spyware through malicious online ads, with at least 45 Al Jazeera Windows computers affected. The lab says Candiru and Bindecy used the platform to target specific people and devices, and it describes this as the first technical confirmation of government-backed spyware delivered through ads.
The mechanism is blunt: the ad itself carried code that could compromise a device without a click. That matters because ad networks are built to target device and audience profiles at scale, so a system sold as monetization infrastructure can also be used as a covert delivery path for surveillance malware.
For media organizations, government teams, and ad-tech operators, the exposure is no longer limited to nuisance malvertising or user error. If your environment depends on ad-supported pages or ad targeting, the risk sits in the delivery chain itself, and browser-level trust in the ad stack becomes part of the attack surface.
1 source covering this story
The digital rights unit found evidence that dozens of devices at media organization Al Jazeera were hacked after being shown malicious online ads.
Part of the PlainSec briefing for 2026-10-15