Candiru Spyware Used Zero-Click Malvertising to Target Al Jazeera Devices
Researchers have uncovered a sophisticated spyware operation that used ordinary online advertisements to target devices belonging to journalists at Al Jazeera. The campaign was linked with high confidence to Candiru, an Israeli commercial spyware vendor whose surveillance tools have been sold to government customers.
According to researchers at the University of Toronto's Citizen Lab, the attacks required no clicks or other interaction from victims. Malicious code embedded in advertisements could execute when an ad loaded, including in some cases when the ad appeared in the background.
The findings provide the first public technical confirmation that commercial spyware has been delivered to real devices through targeted online advertising. Although the technique had previously appeared in leaked company documents, the researchers said this investigation documented its use in an actual operation.
At least 45 devices were targeted during 2024 and 2025. The researchers did not identify the government responsible for the operation.
How the Zero-Click Advertising Attack Worked
The campaign involved Discover-Tech, an Israeli company operating in the digital advertising industry. Researchers found that advertisements associated with the company contained code that quietly collected a device's advertising identifier and IP address when the ad loaded.
The information was sent to a Discover-Tech server, which assessed whether the device matched the operation's targeting criteria. If the device was considered a target, the server delivered code intended to exploit the browser or application. Devices that did not match the criteria received no attack code.
This selective delivery approach made the operation harder to detect because the advertisement itself did not necessarily contain the exploit payload. Advertising networks delivering the content could therefore receive an apparently ordinary ad rather than an obvious malicious file.
The researchers said the attack followed a consistent sequence across compromised devices:
- The device contacted a Discover-Tech advertising server.
- The device communicated with a Candiru server that screened potential targets.
- A command-and-control server subsequently delivered or operated the spyware.
Al Jazeera provided network traffic logs that helped investigators reconstruct this sequence. The organization also recovered a Windows executable from a compromised device.
The executable contained distinctive techniques matching a Candiru tool examined by Citizen Lab in 2021. This technical similarity supported the researchers' high-confidence attribution to Candiru.
However, the researchers did not recover the original exploit used to compromise the browser or application. The initial exploitation mechanism was reconstructed from the operation's infrastructure and behavior rather than directly analyzed from captured exploit code.
Connection to Candiru and Discover-Tech
Candiru is a commercial spyware vendor known for developing surveillance tools used to target journalists, activists, government officials, and other individuals. The United States added the company to its trade blacklist in 2021 over spyware-related activities.
In 2025, Candiru's assets were reportedly acquired by the U.S. investment firm Integrity Partners and transferred into a new company reportedly known as Integrity Labs.
Discover-Tech, meanwhile, presented itself as a conventional digital advertising business. Registered in Israel in 2020, the company was led by chief executive Dekel Boni.
Google and the advertising industry organization IAB Europe had listed Discover-Tech as an approved advertising vendor from 2020 until October 2026, when the findings prompted action against the company.
The investigation did not establish which government, if any, directed the specific operation against Al Jazeera.
A Previous Spyware Incident Involving Al Jazeera
This was not the first reported spyware incident involving Al Jazeera journalists.
In 2020, dozens of journalists associated with the news network had their iPhones compromised using NSO Group's Pegasus spyware. That earlier campaign involved a different operation and attack technique.
The latest findings demonstrate how commercial spyware operations can exploit advertising infrastructure to reach targets without relying on traditional phishing messages or malicious links.
Advertising Platforms Remove Discover-Tech
Following the investigation, several advertising companies and industry organizations took action against Discover-Tech.
Google removed the company from its advertising exchanges, stating that it had systematically violated its policies. IAB Europe suspended Discover-Tech after an audit identified policy violations.
Other companies also responded:
- Beeswax: Removed Discover-Tech following the reported activity.
- Vungle: Paused the company's access while conducting a review.
- Eskimi: Blocked Discover-Tech accounts.
These actions disrupted the company's access to several advertising platforms. However, the findings also highlighted the difficulty of detecting malicious activity when attackers abuse legitimate advertising infrastructure.
The Operation Reached Millions of Advertising Opportunities
The investigation found that Discover-Tech's advertising operations extended well beyond Al Jazeera.
According to Citizen Lab, one of the company's platforms placed nearly four billion advertising bids between March and June 2026. Advertisements containing the hidden callback code appeared across approximately 75,000 mobile applications and 120,000 websites.
Advertising security firm Confiant, which investigated alongside Citizen Lab, estimated that Discover-Tech handled around 10 million ads per day.
Researchers also found that the advertising system reached networks associated with NATO, the United Nations, European Union institutions, government offices in approximately two dozen countries, semiconductor manufacturers, and news organizations.
However, the appearance of an advertisement on an organization's network does not establish that the organization was infected. It demonstrates the potential reach of the advertising infrastructure, not confirmed compromise of every exposed network.
Confiant reported that the limited number of advertisements it directly linked to Candiru were relatively low-volume and primarily reached residential and mobile internet connections rather than sensitive organizational networks.
Indicators of Compromise and Detection
Citizen Lab and Confiant published technical indicators associated with the operation to help security teams investigate possible exposure.
Key indicators include:
- Recovered spyware SHA-256:
255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8 - Discover-Tech advertising domain:
mtrtb[.]com - Additional indicators: Domains, files, and command-and-control infrastructure documented in Confiant's technical report.
Security teams should review DNS logs, proxy records, endpoint telemetry, and network traffic for connections matching the published indicators.
The sequence of connections is particularly relevant: a device contacting a Discover-Tech advertising server, followed by a Candiru screening server and then a command-and-control endpoint.
Organizations should also investigate suspicious executable files and review affected endpoints for evidence of unauthorized code execution. Because the initial exploit was not recovered, the published indicators should be treated as useful detection leads rather than a complete list of all possible artifacts.
Security Implications of Spyware Delivered Through Ads
The campaign highlights a growing risk associated with the advertising ecosystem. Traditional defenses often focus on suspicious links, attachments, and user interactions, but zero-click malvertising can bypass these assumptions by triggering malicious activity when content loads.
Selective targeting, infrastructure screening, and the use of legitimate advertising channels can make these operations difficult to identify through conventional security controls alone.
The findings also reinforce the importance of browser and operating-system updates, restrictive application permissions, network monitoring, and endpoint detection capabilities that can identify suspicious behavior even when no obvious malicious file is present.
Commercial spyware delivered through advertising represents a serious threat to journalists and other high-risk individuals. The discovery of the Al Jazeera operation demonstrates that legitimate advertising infrastructure can be repurposed as a delivery mechanism for highly targeted surveillance campaigns.
