Israeli spyware targeted 'hundreds of millions' through zero-click ads, researchers find

Millions of people's devices have been infected with Israeli mercenary spyware called Candiru through zero-click digital advertisements, Canadian cyber watchdog group The Citizen Lab found in an investigation. The case marks the first-ever zero-click mercenary spyware, confirmed publicly, delivered through targeted ads, the group said in a report published on Thursday. The spyware also targeted devices linked to Al Jazeera Media Network. Discover-Tech, an Israeli company that presents itself as a legitimate ad company but in reality operates for Israeli mercenary spyware partners like Candiru, placed targeted ads that directed millions of devices in dozens of countries to contact Candiru's servers for tracking and reconnaissance, according to the report. The Citizen Lab found that in 2024 and 2025, at least 45 devices within Al Jazeera were targeted in a series of zero-click ad attacks purchased by Discover-Tech. Discover-Tech controls a platform called Controlium that allows "mercenary partners to de-anonymize, fingerprint, and automatically infect devices" as soon as the ad is shown, without having the target even click on it. Read more: Israeli spyware targeted 'hundreds of millions' through zero-click ads, researchers find The Citizen Lab found that in 2024 and 2025, at least 45 devices within Al Jazeera were targeted in ad attacks by Israeli company Discover-Tech (IMAGO/Alexander Limbach via Reuters Connect)