Candiru Spyware Ads Planted Zero-Click Spyware on 45 Al Jazeera Devices, Citizen Lab Says

Researchers have uncovered the first confirmed case of mercenary spyware being delivered to victims through ordinary online advertisements, infecting dozens of devices at the broadcaster Al Jazeera without anyone clicking a single ad. Candiru spyware ads planted zero-click malware on 45 Windows computers at the Qatar-based network in 2024 and 2025, according to a report published on October 15, 2026, by the Citizen Lab at the University of Toronto.

FAKTA

• The University of Toronto’s Citizen Lab says at least 45 Windows devices at Al Jazeera were infected with spyware in 2024 and 2025 through targeted online ads — a technique it calls “AdFection”.
• The researchers attribute the infections with high confidence to Candiru, an Israeli spyware maker, delivered through ads placed by the Israel-based ad firm Discover-Tech.
• A victim needed no click or interaction: infection happened once the ad loaded. Ad platforms Google, IAB Europe and Comcast’s Beeswax have since cut ties with Discover-Tech.
• Al Jazeera condemned the targeting of its staff as “an assault on press freedom” and said those responsible must be held accountable.

How the Candiru spyware ads worked

According to Citizen Lab, Discover-Tech won the split-second real-time bidding auctions that decide which ad a person sees, using its own platform called MyDSP and exchanges run by Google, Yandex, Vungle, China’s Sunteng, Comcast-owned Beeswax and Lithuania’s Eskimi. Winning ads carried a script tag that contacted a Discover-Tech “NOAS” server, which checked the viewer’s IP address and advertising ID.

Almost everyone received an empty, zero-byte reply. A chosen target instead received code that opened an invisible 1×1-pixel frame pointing at a Candiru validator server, which vetted the device before sending it on to an exploit server. Because the malicious code reached only the selected device, the companies serving the ads never saw it. Eskimi told Citizen Lab the advertiser’s tags “were built to evade automated scanning.”

Al Jazeera’s own technology team first noticed unusual activity on some journalists’ devices in 2024 and shared network logs with Citizen Lab. The logs showed what researchers called a clear temporal signature: devices first connected to Discover-Tech infrastructure, then — almost immediately — to servers linked to Candiru’s command-and-control network, a sequence consistent across all 45 devices.

Ad industry cuts ties with Discover-Tech

A New York ad security firm, Confiant, published a parallel investigation on the same day. Its co-founder Jerome Dangu told Reuters the Discover-Tech ads were especially common on websites in the Palestinian territories, and that its ads also appeared on networks used by the Pentagon, the International Atomic Energy Agency and the International Criminal Court.

After the findings, Google said it had removed Discover-Tech from its ad platforms for systematically violating its policies, IAB Europe suspended the company from its global vendor list, and Beeswax also dropped it. Citizen Lab says it found no evidence that Discover-Tech did ordinary advertising work, and describes its Controlium platform as letting spyware firms profile millions of users and then hack chosen targets with harmless-looking ads.

Press freedom and accountability

Al Jazeera said it condemns the spyware attacks targeting a number of its staff and pledged to continue measures to protect its employees and systems. The network called the targeting of journalists an assault on press freedom.

Citizen Lab stressed that it could not identify which government, if any, ordered the operation against Al Jazeera. The researchers recovered the spyware itself from one device, but not the exploit that first broke into the browser or app. The lab describes AdFection as the first public, technical confirmation that mercenary spyware — hacking tools sold to governments — has reached real devices through targeted ads.

Read more technology stories at Watan News.