Citizen Lab said Oct. 15 that targeted online ads delivered Candiru spyware to devices at Al Jazeera without users clicking anything, linking the attacks to Israeli ad-tech firm Discover-Tech.
The University of Toronto research group called the method “AdFection” and described it as the first publicly confirmed case of mercenary spyware delivered through targeted advertising. It said at least 45 Al Jazeera devices were targeted in 2024 and 2025, after the network’s technology team noticed unusual activity on journalists’ devices and shared network logs for analysis. Researchers traced a pattern in those logs from Discover-Tech ad servers to Candiru infrastructure, which they said supported their finding that spyware infections had occurred.
According to the report, Discover-Tech’s Controlium platform could identify and fingerprint selected devices, then trigger code when an ad appeared—so a victim did not need to tap, open a link or download a file. The researchers analyzed four billion bidding records and found Discover-Tech ads had appeared on nearly 200,000 websites and mobile apps across dozens of countries over four months; they cautioned that broad ad exposure does not mean every device was infected. The report also said millions of devices were covertly directed to Candiru servers, potentially for tracking or reconnaissance, but did not identify which government, if any, ordered the Al Jazeera operation.
Al Jazeera condemned the targeting of its staff and said it would continue working to protect its employees and systems.