Governments are hacking people with ‘zero-click’ spyware by showing them online ads
- ID
- 35757
- Status
- summarized
- Published
- 15 Oct 2026, 6:00 PM
- Fetched
- 16 Oct 2026, 3:46 AM
- Provider
- TechCrunch
- Category
- technology
- Original URL
- https://techcrunch.com/2026/10/15/citizen-lab-says-governments-are-abusing-online-ads-to-hack-people-with-zero-click-spyware/
- Source URL
- https://techcrunch.com/feed/
Summary
- Score
- 5.5
- Created
- 16 Oct 2026, 3:47 AM
- Tags
- Audience
- developerssaas_founders
What happened
Citizen Lab published a report on October 15, 2026, saying an Israeli company called Discover-Tech sells access to its advertising platform that acts as a "bridge between ad vendors and the mercenary spyware ecosystem." At least two zero-click spyware makers, Candiru and Bindecy, used the platform to target people, and one campaign infected at least 45 Windows computers at Al Jazeera in 2024 and 2025. Citizen Lab calls this the first concrete technical evidence of government-backed zero-click spyware being delivered through online ads, though it says which governments were behind the attacks is unclear.
Why it matters
The actionable detail is that the delivery vector was ordinary ad inventory, not a phishing link or a malicious attachment, so endpoint tooling and user training that assume a click would not have flagged it. For most builders this is a targeted surveillance tool aimed at specific people (journalists, activists), not a mass exploit against your users, so it is worth knowing but does not require an immediate change to your stack. If you embed third-party ad SDKs or run ad-supported products, the decision it informs is whether you can actually audit what those networks serve and to whom, and the honest answer for most teams is no.
Discussion angle
Ad networks as an attack delivery channel: if this only works on precisely targeted devices, what would detection even look like on a normal developer machine, and is there anything a team shipping third-party ad SDKs could realistically verify about the inventory being served?