Israeli spyware maker Candiru used malicious online ads to target Al Jazeera devices, infecting them without requiring victims to click a link or take any other action, according to new research from the University of Toronto’s Citizen Lab.
In a report published Thursday, researchers said the operation exploited the digital advertising ecosystem to deliver spyware to selected targets. The attacks affected at least 45 devices associated with Al Jazeera during 2024 and 2025, with investigators linking the activity to Candiru with high confidence. However, they did not identify the government believed to be behind the operation.
The technique is particularly concerning because the attack could begin when an advertisement loaded on a device, including in some cases when the ad appeared out of sight in the background. This type of attack, commonly described as zero-click, does not require victims to open a suspicious attachment, click a link, or interact with the advertisement.
Citizen Lab described the findings as the first public technical confirmation that mercenary spyware had reached real devices through targeted advertising. Although leaked documents had previously suggested that commercial spyware operators could exploit online advertising to conduct surveillance, the researchers said this investigation provided evidence of the technique being used in a real-world operation.
The attack infrastructure involved an Israeli advertising company called Discover-Tech, which presented itself as a legitimate digital advertising business. According to the investigation, advertisements distributed through its systems contained code that silently collected a device’s advertising identifier and IP address when the ad loaded. The information was then sent to a Discover-Tech server for evaluation.
If a device matched the operation’s targeting criteria, the server could deliver additional code intended to exploit the browser or application advertising. Devices that did not match the criteria received no further malicious payload. Because the initial advertisement did not necessarily contain the exploit itself, conventional advertising security checks could have difficulty identifying the activity as malicious.
The researchers reconstructed the attack using network traffic logs provided by Al Jazeera. On affected devices, the logs showed a consistent sequence of connections: first to a Discover-Tech advertising server, then to a Candiru server that screened the device, and finally to a command-and-control server associated with spyware activity.
Al Jazeera also recovered a Windows executable from a compromised device. Citizen Lab researchers found that the program used techniques similar to those found in a Candiru spyware tool they analyzed in 2021. This technical similarity supported their assessment that Candiru was responsible for the operation, although the researchers did not recover the original exploit used to break into the devices.
Discover-Tech’s advertising infrastructure had a much wider reach than the confirmed Al Jazeera targeting. Citizen Lab reported that one of the company’s platforms made nearly four billion advertising bids between March and June 2026. Advertisements carrying the hidden callback code appeared across approximately 75,000 mobile applications and 120,000 websites.
Advertising security company Confiant, which investigated the operation alongside Citizen Lab, estimated that Discover-Tech handled roughly 10 million advertisements per day. Researchers also found evidence that its advertising activity reached networks associated with governments, international organizations, technology companies, and news organizations.
These findings do not mean that every organization exposed to the advertisements was infected. The appearance of an advertisement on a particular network only demonstrates potential reach, not successful exploitation or spyware installation.
Discover-Tech had previously been listed as an approved advertising vendor by Google and the advertising industry group IAB Europe. Following the researchers’ findings, both organizations removed the company from their vendor lists in early October. Google also cut off its access to advertising exchanges, while other advertising platforms took steps to suspend or block its accounts.
Google told Reuters that it had worked with researchers and removed Discover-Tech for systematically violating its policies. IAB Europe said it suspended the company after an audit identified policy violations. Comcast, which owns the advertising platform Beeswax, also confirmed action following the reported activity.
Candiru is a well-known supplier of commercial spyware sold to government customers. In 2021, the U.S. Commerce Department added the company to its Entity List over allegations that its spyware had been used to target government officials, journalists, and activists. In 2025, Candiru’s assets were reportedly acquired by U.S. investment firm Integrity Partners and transferred into a new corporate structure.
The incident is not the first time Al Jazeera journalists have been targeted with commercial spyware. In 2020, researchers reported that dozens of journalists’ iPhones had been compromised using NSO Group’s Pegasus spyware in a separate operation.
Citizen Lab and Confiant have published technical indicators associated with the latest campaign to help security teams investigate potential exposure. These include a recovered spyware file hash, advertising infrastructure domains, and additional network indicators that organizations can use to search their logs and security systems.
One published indicator is the SHA-256 hash of the recovered spyware sample: 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8. Researchers also identified mtrtb[.]com as a domain associated with Discover-Tech’s advertising infrastructure.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Security teams should review the indicators published in the research, investigate suspicious connections involving advertising servers and known spyware infrastructure, and examine endpoint telemetry for signs of compromise. Organizations should also keep operating systems, browsers, and applications updated, while recognizing that ordinary security updates alone may not prevent every targeted zero-day attack.
Sources
- Citizen Lab — How Discover-Tech Turned Targeted Ads Into a Pipeline for Spyware
- Confiant — AdINT: Weaponized Ad Tech for Zero-Click Spyware
- Citizen Lab — Hooking Candiru
- U.S. Commerce Department — Spyware Companies Added to the Entity List
