Citizen Lab documents spyware attacks on Al Jazeera devices through online ads
A new report traces attacks in 2024 and 2025 to targeted advertising and Candiru spyware. Researchers have not identified the governments behind them.
Citizen Lab said on October 15 that targeted online advertisements delivered zero-click Candiru spyware to devices at international news network Al Jazeera during attacks in 2024 and 2025. The newly published findings show how an ad displayed on a device could become a route for infection without its user clicking it.
The research group calls its report the first public technical confirmation of a zero-click mercenary spyware attack delivered through targeted advertising. WIRED reported that Citizen Lab concluded 45 Al Jazeera devices were targeted; TechCrunch described at least 45 Windows computers as apparently hacked. Those accounts use different terms for the extent of compromise.
WIRED reported that Al Jazeera took part in the investigation and shared device logs with researchers. The broadcaster did not respond to WIRED’s request for comment.
How Discover-Tech’s ads reached devices
Citizen Lab said the malicious ads were bought by Discover-Tech, an Israeli company that presents itself as an advertising firm. According to the researchers, its Controlium platform could profile and de-anonymize users, fingerprint their devices and automatically infect a device when an ad was rendered.
In an analysis of four billion Discover-Tech bidding records, Citizen Lab found its ads had appeared on almost 200,000 distinct websites and Android or iOS apps across dozens of countries over four months. The group said the ads covertly caused millions of devices to contact Candiru servers, likely for tracking and reconnaissance. That wider contact figure is not an infection count.
Citizen Lab linked Discover-Tech to spyware vendors Candiru, Intelos and Bindecy. TechCrunch also reported that Candiru and Bindecy used the advertising platform. The researchers recreated Discover-Tech’s web control panel after finding source code exposed on its login pages, TechCrunch reported.
Other networks appeared in the ad records
TechCrunch reported that the bidding records showed ads on devices used by militaries, governments, critical infrastructure and national cyber agencies. It also reported that Confiant, which worked with Citizen Lab, found potentially malicious ads on networks of the International Atomic Energy Agency and the International Criminal Court. The available findings do not establish whether those ads infected devices on those networks.
Citizen Lab attributed the Al Jazeera infections to Candiru spyware. TechCrunch reported that the researchers could not establish which governments were behind the attacks.
Read in depth: Technology
Apple closes above $5 trillion for the first time as technology stocks fall
Apple ended Oct. 14 with a reported market value of $5.01 trillion, reaching a milestone it had previously passed only during trading hours.
Microsoft and MIT researchers report gains in forecasts two to six weeks ahead
A study published October 14 describes a machine-learning method that corrects bias in existing weather forecasts, with reported gains in precipitation and temperature predictions.
Sources and context
- Citizen Lab says governments are abusing online ads to hack people with 'zero-click' spywareTechCrunch
- ‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted AdsWIRED
- Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary SpywareThe Citizen Lab, University of Toronto
AI-assisted article checked against the listed sources. NewsJaws did not conduct interviews or attend the reported events.