Researchers at the University of Citizen Lab have revealed that Israeli commercial spyware from Candiru infected at least 45 devices within Al Jazeera in 2024 and 2025 using zero-click banner ads. The discovery marks the first public technical confirmation of mercenary spyware delivered through targeted programmatic advertising.
How Banner Ads Silently Delivered Candiru Spyware Without a Single Click
The attack vector bypassed normal user interaction entirely by exploiting standard advertising infrastructure across the internet. A Tel Aviv-based advertising technology firm named Discover-Tech operated as a bridge between the digital ad market and commercial spyware developers, according to an investigation published by the University of Citizen Lab.
A MAJOR NEW danger for internet users was revealed today. A “zero-click mercenary spyware” program has been deployed by an Israeli company, researchers at the University of Toronto warned.It enables the hacking of your phone or computer using ads on your screen—without any need… pic.twitter.com/5F7yoXGDpr
Discover-Tech utilized a platform called Controlium that allows mercenary partners to de-anonymize, fingerprint, and automatically infect devices as soon as an ad is shown, without having the target even click on it, the Canadian cyber watchdog group found.
It’s kind of a nightmare because it shows that devices can potentially be infected by spyware mercenaries, spyware companies, by just viewing an ad on a website or in a mobile app silently.
Wolfie Christl, co-author of the Citizen Lab report
Mr. Christl noted that the ads are not just images or videos, but carry code that is executed in the background, which is how the infection happens. Very likely hundreds of millions of people would have been touched by Discover-Tech, according to Confiant co-founder Jerome Dangu.
What Al Jazeera’s Recovered Files Revealed About the 2024 and 2025 Campaigns
The investigation began after internal security teams at the Qatari international broadcaster Al Jazeera detected network log anomalies and shared the data with researchers. Logs showed devices connecting first to Discover-Tech infrastructure and immediately afterward to Candiru command-and-control servers.
Technical analysis confirmed that at least 45 Windows devices on Al Jazeera’s network were targeted through AdFection attacks between 2024 and 2025.
Al Jazeera publicly condemned the targeting of its journalists as an assault on press freedom. This campaign marked the second independent state-sponsored surveillance operation against the network, following 2021 findings involving Pegasus zero-click exploits attributed to Saudi Arabia and the United Arab Emirates.
Which Government Networks and Global Entities Were Reached by the Advertising Infrastructure
Beyond media organizations, Discover-Tech advertisements were shown on devices in national-security-sensitive networks around the world, including those of defense ministries, militaries, national cybersecurity agencies, media organizations, and intergovernmental and security organizations such as NATO.
How Candiru Rebranded Following US Sanctions and Integrity Partners Acquisition
Candiru developed surveillance software capable of extracting messages, emails, and photographs while activating device cameras and microphones. Candiru was also used to target Middle East Eye and other websites in November 2021, following an attack discovered by online security firm ESET that targeted MEE’s website during two days in April 2020.
Between January and June 2026, Citizen Lab identified 3,637,213 eligible users whose devices had been fingerprinted against the Candiru target list and routed toward Candiru’s profiling infrastructure.
What Ad Industry Giants Did After Discover-Tech’s Operations Were Exposed
Major participants in the digital advertising ecosystem moved quickly to sever ties with the implicated adtech firm.
Mr. Christl stated that the international community must investigate the companies revealed in the investigation and think about how to fix the system, warning that digital advertising is broken and constitutes a security threat for states, the private sector, civil society, and everyone else.