Citizen Lab reports that Candiru spyware infected devices at Al Jazeera via ordinary online ads requiring no user interaction.
The analysis details how hidden code executed automatically upon ad load through an approved ad vendor, marking the first public confirmation of commercial spyware reaching real targets via standard digital advertising channels.
The research, conducted by Citizen Lab, a research group at the University of Toronto, is the first public confirmation that surveillance programs sold to governments have managed to reach real devices through targeted advertising.
How the trap was set in the ads
The ads were placed by an Israeli company called Discover-Tech, which posed as a legitimate advertising agency. Each ad contained hidden code that was activated as soon as the ad loaded on the screen or even silently in the background. This code sent the device’s web address and advertising ID back to a server.
This server then checked to see if the device belonged to a specific target person. If it matched, it sent attack code that was executed by the browser or app. Because the original ad didn’t look suspicious, the ad networks that delivered it couldn’t detect the problem.
The targeting of Al Jazeera and the connection to Candiru
According to Citizen Lab, at least 45 devices at Al Jazeera were targeted during 2024 and 2025. Researchers link these attacks with a high degree of certainty to Candiru, an Israeli spyware company.
READ ALSO
Ads on websites and apps secretly installed tracking software
The network provided the researchers with logs of its traffic. On compromised devices, the logs always showed the same sequence: first contact with a Discover-Tech ad server, then contact with a Candiru server to control the device, and finally connection to a server running the spyware.
Al Jazeera was also able to isolate a Windows program file from a compromised device. The code in this file used exactly the same special techniques as a Candiru tool that Citizen Lab had analyzed in 2021.
The broader action and measures from the platforms
Discover-Tech's activity was not limited to Al Jazeera. Between March and June 2026, the company submitted nearly four billion ad proposals to one of its platforms, with the ads appearing on about 75.000 mobile apps and 120.000 websites.
Following the researchers’ notification, companies such as Google and IAB Europe removed Discover-Tech from their approved partner lists in October. At the same time, companies such as Google, Beeswax, Vungle, and Eskimi took action to block or remove Discover-Tech’s access to their services.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)