An Israeli adtech has been accused of using ads to deliver spyware to Al-Jazeera staff.
Spyware has been placed on dozens of devices using malicious ads, an investigation by Citizen Lab and Al Jazeera has confirmed.
The attack featured zero-click malware, delivered through targeted ads, and is the first known instance of its kind. It operates without the targeted device or users needing to press a link or take any action. Instead the ad delivers malicious code to exfiltrate data – all the user has to do is view it like every other ad.
The investigation accused Candiru, an Israeli spyware firm, of being behind the attacks, and planted the malware using this zero-click technique.
Candiru has allegedly been leveraged in several other high-profile attacks, and the firm is blacklisted by the US government for its involvement in malicious cyber activities.
Discover-Tech, a specialised digital advertising agency has also been accused of targeting Al Jazeera journalists and infecting their devices with the spyware, which the media network has dubbed an “assault on press freedom”.
This attack was unique in its sophistication as it did not require users to enter their details. Citizen Lab, a research unit of the University of Toronto concluded that Discover-Tech purchased the ads with built-in malware, and directed devices to Candiru’s malware.
Adfection: Track infrastructure under threat
Once a device is infected with spyware, it feeds the victim’s information back to the adtech, including any sensitive data that might be accessed on the device. This can include keystrokes, files, browser data, cookies, saved passwords, and the malware can even go as far as to take screenshots, microphone recordings, webcam feeds, and exfiltrate emails and messages from platforms accessed.
The tool used in this instance is reported by Al Jazeera to have been worth millions of dollars.
Al Jazeera’s in-house tech team first detected unusual device patterns in 2024, and as these continued into 2025, the media company reached out to Citizen Lab for an investigation into its suspicions that journalists were targeted with spyware.
Citizen Lab said in its report: “Discover-Tech has appeared on lists of ‘certified’ and ‘approved’ vendors maintained by Google and advertising industry association IAB Europe, and has served ads via major networks such as Google, Yandex, and Beeswax.
“Discover-Tech has also leveraged the European General Data Protection Regulation (GDPR) consent frameworks to target users within the European Union.”
Crucially, Discover-Tech was able to evade detections within the real-time bidding (RTB) auction network. These RTB auctions, hosted on AdX, Google’s ad exchange, happen billions of times a day, with bidding taking under a second to complete.
Online ads are not just an image or video, but can contain code from third parties to track, tag, and identify users.
The ads can deliver code to browsers or apps, which collects and shares information about the user and their device. This can include IP addresses, precise locations, and device identifiers.
Such aggressive targeting data opens up the opportunity for malicious actors to collect hoards of information about the target. A company with auction data can track users without their knowledge.
Citizen Lab’s report explained: “In fact, the surveillance industry sells access to so-called ad intelligence (ADINT) platforms that leverage this sort of data, often combined with third-party tracking data. In recent years, several investigations and media reports have uncovered vendors that sell ADINT to defense, intelligence, and law enforcement agencies.”
As the scale of tracking within ads develops, the ad ecosystem becomes a vehicle for bad actors to leverage. The existence of tracking infrastructure leaves the industry vulnerable to malicious attackers, as the framework itself has become a point of weakness.
