Spyware Hidden in Online Ads Infected Al Jazeera Devices Without a Single Click

Israeli spyware maker Candiru infected devices at Al Jazeera through ordinary online ads that required no user interaction, researchers at the Citizen Lab confirmed Thursday in a landmark cybersecurity finding.

The Citizen Lab, a research group at the University of Toronto, announced this is the first publicly documented and technically confirmed case of mercenary spyware reaching real devices through targeted advertising. The method had previously appeared only in leaked company documents. Now it has been caught in a live operation — and the implications for digital security worldwide are profound.

---

How Spyware Hid Inside Everyday Ads

The attack worked through a company called Discover-Tech, an Israeli firm registered in 2020 that presented itself as an ordinary digital advertising business. Its chief executive is Dekel Boni. The company was approved as a vendor by both Google and the advertising trade group IAB Europe from 2020 until early October 2026.

Each ad served by Discover-Tech carried a small piece of embedded code. The moment the ad loaded on a screen — even if it loaded invisibly in the background — that code quietly transmitted the device's advertising ID and internet address to a Discover-Tech server. That server then made a decision: if the device belonged to a known target, it returned attack code for the browser or app to execute. If the device was not a target, the server returned nothing.

Because the ad itself contained no malicious payload at delivery, the ad networks carrying it had nothing harmful to detect. The attack code arrived only after the server confirmed it was speaking to a target. This is what makes the technique so technically sophisticated — and so difficult to defend against using conventional security tooling.

The Infection Chain at Al Jazeera

At Al Jazeera, the Citizen Lab said at least 45 devices were targeted during 2024 and 2025. The network's own traffic logs revealed the same sequence on every infected device:

1. Contact with a Discover-Tech ad server
2. A handoff to a Candiru screening server
3. Connection to a command-and-control server that operated the spyware remotely

Al Jazeera also recovered one Windows program file from a compromised device. Its code used the same distinctive techniques found in a Candiru tool the Citizen Lab had analyzed in 2021, forming the basis for its high-confidence attribution to Candiru. The researchers did not identify which government commissioned the attacks.

Understanding how this delivery mechanism fits within the broader landscape of the different types of malware and how they operate helps explain why ad-delivered spyware is particularly dangerous — it exploits trusted infrastructure rather than suspicious files or links.

This is not the first time Al Jazeera staff have been targeted. In 2020, dozens of its journalists' iPhones were compromised using NSO Group's Pegasus spyware in a separate operation using a different method.

---

Who Candiru Is and What Happened to Discover-Tech

Candiru is one of the more established names in the commercial spyware industry. The United States placed it on a trade blacklist in 2021, citing its spyware being used against government officials, journalists, and activists. In 2025, its assets were acquired by a U.S. investment firm called Integrity Partners and moved into a new entity reported to be Integrity Labs — a structure that places it outside the reach of existing sanctions.

After the Citizen Lab shared its findings with the platforms involved, the response was swift. Google and IAB Europe removed Discover-Tech from their approved vendor lists in early October 2026. Google cut off the company's access to its ad exchanges and told Reuters it had removed Discover-Tech "for systematically violating our policies." IAB Europe said it suspended the company following an audit that found policy violations. Ad platforms Beeswax, owned by Comcast, and Eskimi also blocked the company's accounts. Vungle paused Discover-Tech's access pending a review.

Discover-Tech, Candiru's current owners, Al Jazeera, and Russian ad network Yandex did not respond to requests for comment. As of Thursday, Discover-Tech's website remained online and made no reference to the findings.

Why Vendor Vetting Failed

The approval of Discover-Tech by both Google and IAB Europe for over six years highlights a structural gap in how ad networks vet their technology partners. Because the malicious behaviour was conditional — triggered only when a confirmed target was identified — the company's ad traffic appeared entirely clean under standard inspection. No payload was ever delivered to a non-target device, giving audits no obvious anomaly to catch.

This approach mirrors the logic behind zero-day exploits and the methods used to prevent them — attacks designed to evade detection by exploiting gaps that defenders have not yet identified or closed. In this case, the gap was not a software vulnerability but a procedural one baked into the advertising ecosystem itself.

---

The Scale of the Operation Extended Far Beyond One Newsroom

The reach of Discover-Tech's advertising infrastructure was vast. Between March and June 2026 alone, the company placed nearly four billion ad bids on one platform, the Citizen Lab said. Ads carrying the hidden callback code appeared across approximately:

• 75,000 phone apps
• 120,000 websites

U.S. ad-security firm Confiant, which investigated alongside the Citizen Lab, estimated Discover-Tech's traffic at roughly 10 million ads per day.

Those ads reached networks associated with NATO, the United Nations, European Union institutions, government offices in approximately two dozen countries, semiconductor manufacturers, and news organizations. An ad appearing on a network does not confirm that anyone there was infected — it reflects only the potential reach of the delivery system. Confiant found that the smaller subset of ads it could directly tie to Candiru were lower in volume and reached mostly home and mobile internet connections rather than sensitive institutional networks.

The Threat to Mobile Devices

The inclusion of mobile apps within the delivery infrastructure is particularly significant. A large proportion of programmatic advertising now flows through mobile environments, where users have limited visibility into what code executes when an ad loads. Organisations and individuals operating in high-risk environments — journalists, activists, government staff — should be aware of the documented and growing risk of mobile malware attacks targeting smartphones and apps, which this operation demonstrates can be initiated without any user action whatsoever.

Prior Warnings and the Intellexa Parallel

Security researchers have warned for years that the programmatic advertising ecosystem could be weaponised this way. In December, leaked documents connected spyware maker Intellexa to a similar ad-based tool called Aladdin, though no confirmed live infection through that system had been publicly documented.

This investigation is the first to move that threat from theory to confirmed reality.

What Security Teams and Organisations Should Do Now

Both the Citizen Lab and Confiant published technical indicators from the operation, including the SHA-256 hash of the recovered spyware sample and associated domain names, so defenders can search their own records and block known infrastructure.

For security teams, communications professionals, and journalists in particular, this investigation points to three practical steps:

1. Audit your organisation's ad traffic logs for the connection sequence described above — Discover-Tech ad server contact, followed by a Candiru screening server, followed by a command-and-control server
2. Use the published indicators to search historical records for signs of compromise
3. Advocate for stronger vetting standards from every ad network your organisation touches

The case confirms that the line between browsing the internet and being surveilled has grown dangerously thin. The programmatic advertising system, built on speed and scale, has created conditions where a patient and well-resourced attacker can reach almost any connected device — without the target ever clicking a thing.