Candiru Spyware Hit Al Jazeera Through Online Ads Nobody Clicked

Nobody at Al Jazeera clicked anything. The spyware arrived inside ordinary online ads, and the attack code ran as soon as an ad loaded. In some cases the ad loaded in the background where no one could see it. On Thursday the Citizen Lab, a research group at the University of Toronto, said at least 45 devices at the network were targeted in 2024 and 2025. It linked the operation with high confidence to Candiru, an Israeli company that sells spyware to governments.

The researchers call this the first public, technical confirmation that mercenary spyware has reached real devices through targeted ads. Leaked company documents had described the method before, but no one had shown it in a live attack. The company that placed the ads, Discover-Tech, was an approved ad vendor on lists kept by Google and IAB Europe from 2020 until this month.

A newsroom targeted twice

This is not the first time Al Jazeera staff have been targeted. In 2020, dozens of its journalists' iPhones were hacked with NSO Group's Pegasus spyware, in a separate operation that used a different method. This time the network handed its traffic logs to the researchers and pulled a Windows program file off a compromised device. That file used the same distinctive techniques as a Candiru tool the Citizen Lab took apart in 2021, and that match is the basis for the high-confidence attribution. The Citizen Lab did not say which government was behind the operation.

How an ad became an exploit

On every infected device, the logs showed the same sequence:

• A Discover-Tech ad loads. A small piece of code in it sends the device's advertising ID and internet address to a Discover-Tech server.
• That server checks whether the device belongs to a target. If it does not, the server sends nothing back.
• If it does, the server returns attack code for the browser or app to run, and the device contacts a Candiru server that screens it.
• A command-and-control server then runs the spyware.

The design choice that matters most is that the ad itself carried no attack code. The decision about who to attack was made on Discover-Tech's server, so the ad networks that delivered the ad had nothing harmful to find. Scanning ad creatives could not have caught it.

An approved vendor inside the ad system

Discover-Tech presents itself as a normal digital advertising firm. It was registered in Israel in 2020 and is led by its chief executive, Dekel Boni. Candiru is far better known. The United States added it to a trade blacklist in 2021 over spyware used against government officials, journalists and activists. In 2025 a U.S. investment firm, Integrity Partners, bought Candiru's assets and moved them into a new company, reported to be Integrity Labs, which the sanctions do not cover.

The platforms acted once the researchers shared their findings. Google and IAB Europe removed Discover-Tech from their vendor lists in early October. Google also cut off its access to Google's ad exchanges and told Reuters the company was removed "for systematically violating our policies." IAB Europe said an audit had found policy violations. Beeswax removed the company, and its owner Comcast said it acted "following recent activity." Vungle paused Discover-Tech's access pending a review, and Eskimi blocked its accounts. Discover-Tech, Candiru's owners, Al Jazeera and the Russian ad network Yandex did not respond to Reuters. On Thursday, Discover-Tech's website was still online and made no mention of the findings.

Reach is not infection

The ad operation reached far beyond one newsroom. On one of its platforms, Discover-Tech placed nearly four billion ad bids between March and June 2026. Ads carrying the hidden callback code appeared in about 75,000 phone apps and 120,000 websites. Confiant, a U.S. ad-security firm that investigated alongside the Citizen Lab, estimated Discover-Tech's traffic at roughly 10 million ads a day. The ads appeared on networks belonging to NATO, the United Nations, European Union bodies, government offices in about two dozen countries, chipmakers and news organizations.

An ad showing up on a network does not mean anyone there was infected. It shows how widely the system could reach. Confiant found that the few ads it could tie directly to Candiru were low in volume and mostly reached home and mobile internet connections, not the sensitive networks themselves.

The RedEye take

This is a failure of trust in the ad industry as much as a spyware story. Being an approved vendor meant Discover-Tech had passed a membership check. It did not mean anyone had vetted its security, yet the company kept that status for about six years. Because targeting decisions were made on the server, content scanning by ad networks was blind to the attack by design. Researchers have warned for years that the ad-buying system could be used this way. In December, leaked documents tied the spyware maker Intellexa to a similar ad-based tool called Aladdin, but no live infection had been shown. The Citizen Lab has now shown one. Organizations should treat programmatic ads as a channel that can run untrusted code against their highest-risk people, and should stop assuming the ad industry polices itself. The Candiru asset sale also shows that sanctions limit a company, not its capability.

What defenders should learn

• The advertising ID is a targeting key. Discover-Tech chose victims by advertising ID and IP address, so ad tracking on high-risk staff devices is a security exposure, not only a privacy setting.
• Log retention made attribution possible. The case rested on Al Jazeera's traffic logs, which showed the same sequence from ad server to screening server to command-and-control. Organizations that keep network logs for long periods can review past activity once new indicators are published.
• The risk sits off the corporate network. Confiant found the Candiru-linked ads mostly reached home and mobile connections. Perimeter controls never saw that traffic, so threat models for journalists and executives need to cover their personal connectivity.
• Platform approval is not vendor vetting. If Google and IAB Europe listed this vendor for about six years, third-party risk programs should not treat an industry certification as proof of trust.
• Blacklisting does not retire a threat. Candiru's assets moved to an entity the sanctions do not cover, so a vendor's sanctions status says little about whether its tools are still in use.

Source: The Hacker News, "Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads," October 15, 2026, reporting on research by the Citizen Lab and Confiant (https://thehackernews.com/2026/10/citizen-lab-traces-zero-click-candiru.html).