An Israeli advertising company helped deliver spyware to Al Jazeera devices through online ads that required no clicks, the University of Toronto’s Citizen Lab reported Thursday.
At least 45 devices at the news network were targeted in 2024 and 2025. Citizen Lab said its investigation confirmed infections involving spyware from Candiru, an Israeli-founded surveillance company.
Al Jazeera supplied network logs, and researchers examined a Windows spyware file recovered from a compromised device. Citizen Lab attributed the attacks to Candiru with high confidence. Virginia Times has not independently verified the infections.
The researchers traced the delivery system to Discover-Tech and its Controlium platform. They call the technique “AdFection”: attackers use online advertising to identify users and send malicious code to selected devices when an ad loads.
A person did not have to click the advertisement. The platform could use advertising identifiers and IP addresses to distinguish a target from other recipients, according to Citizen Lab.
An examination of nearly 4 billion bidding records showed ads carrying attacker script tags appeared on 120,768 websites and in 75,373 mobile apps between March and June 2026.
Those figures describe the reach of the advertisements, not the number of infected devices. Citizen Lab said the operation combined broad collection of user information with attacks against selected targets.
In a parallel investigation published Oct. 15, advertising security firm Confiant estimated that Discover-Tech served about 10 million ads daily. Ads connecting recipients to Candiru-linked infrastructure accounted for a small portion of that activity.
Confiant also documented code that collected browser cookies. What it could obtain depended on how the advertisement appeared on a page; cookies protected by the browser’s HttpOnly setting were outside that collection method.
The Palestinian territories had the highest share of Discover-Tech advertisements in Confiant’s observations. The company accounted for 1.9% of ads in that dataset, reaching 9.9% on April 7.
The firm also found advertisements reaching government, judicial, defense and university networks. It cautioned that an ad appearing on an institution’s network did not establish that a particular person was targeted or infected.
Discover-Tech had appeared on Google’s vendor lists since 2020. Google removed it and ended its access to advertising exchanges in the first week of October, before the findings were published, Citizen Lab reported.
Comcast-owned Beeswax also removed Discover-Tech. In a response published with the investigation, Beeswax said it acted after detecting activity that independent security specialists subsequently validated.
Discover-Tech and Candiru, now operating as Integrity Labs, did not respond to Citizen Lab’s requests for comment by its deadline.
Citizen Lab urged advertising companies to strengthen oversight of their partners. For users, it recommended trusted ad blockers, browsers that limit tracking and controls that disable or reset advertising identifiers. People facing a heightened risk of surveillance should seek expert assistance, the researchers advised.
