Candiru Spyware Reached Al Jazeera Devices Through Ordinary Online Ads

Candiru spyware reached devices at Al Jazeera without a single click, and the way in was an ordinary online ad. That is the central finding of a report from The Citizen Lab, a research group at the University of Toronto, published Thursday, October 15. The researchers call the method AdFection.

The report is the first public technical proof that mercenary spyware reached real devices through targeted ads. According to Citizen Lab, as reported by The Hacker News, the method had previously been described only in leaked company documents.

Most spyware reporting has centered on phishing links and software exploits, where a person has to tap something or a flaw has to be present. This case suggests that loading a page with an ad on it can be enough to start an intrusion. That shifts the risk onto the ad supply chain, which most readers never see.

Candiru spyware Al Jazeera: what the researchers found

Candiru is an Israeli spyware maker that sells its tools to governments. Citizen Lab says Candiru infected devices at Al Jazeera through ordinary online ads, and the group operates under the name Integrity Labs. Citizen Lab first exposed Candiru in 2021, the same year the US Commerce Department put the company on its blacklist.

That history matters. A vendor the US government has blacklisted reached devices through commercial ad systems that run on ordinary websites and apps.

Citizen Lab put its central claim in plain terms: "This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads." The sentence is short, but it carries the report's main claim.

How the AdFection attack worked

Discover-Tech, an Israeli digital advertising firm, placed the ads. The company presents itself as a normal ad business. Citizen Lab says it acted as a go-between for several spyware vendors, Candiru among them, and the ads moved through ordinary real-time ad auctions.

The mechanism had four steps, according to the reporting:

• Each ad carried a script.
• The script sent the device's advertising ID and IP address to a Discover-Tech server.
• The server decided whether the device was a target.
• Only targets received attack code.

The filter is the detail that matters most. A device that did not match the target profile never received attack code, which helps explain how the activity stayed hidden for as long as it did. A user scrolling past one of these ads had no visible cue that anything was happening.

One gap remains. Researchers recovered the spyware from one device, but not the browser or app exploit that installed it. Citizen Lab reconstructed that first step from how the attack was set up, so readers should treat it as an informed inference rather than a captured sample.

Which devices and networks were exposed

Citizen Lab reports that at least 45 Al Jazeera devices were targeted in 2024 and 2025. The researchers confirmed infections but did not establish that all 45 devices were compromised, as eSecurity Planet noted. One outlet, AI Weekly, describes all 45 as compromised, and the sources reviewed do not resolve that conflict.

The reach went far past one broadcaster. Through its partnerships, Discover-Tech's ads reached more than 120,000 websites and 75,000 apps, according to reporting from the Jerusalem Post. Citizen Lab also reports that the same ad infrastructure appeared on networks used by NATO, the United Nations, EU institutions and the US Department of Defense, as Technology.org reported.

For American readers, the exposure is broad but not uniform. Any US consumer, employee or journalist whose devices load mainstream ads could be exposed in principle. Citizen Lab found that the data collection reached far more devices than the confirmed infections, so being swept into the data is not the same as being hacked.

The Defense Department finding needs careful reading. The reported fact is that Discover-Tech ads appeared on Department of Defense networks. The sources reviewed do not report confirmed infections on those networks, and no agency has commented in the material available.

The table below separates what the reporting establishes from what remains open.

Why Google and IAB Europe cut off Discover-Tech

Discover-Tech had been on approved vendor lists at Google and at IAB Europe, the ad-industry trade body, since 2020. Both have now cut the firm off. Beeswax, Vungle and Eskimi have also blocked or paused it, according to TheNextWeb.

The vetting question is now central. The ads passed through ad platforms run by Google and Comcast, which puts the screening of ad vendors under scrutiny. A vendor that sat on approved lists for years raises the question of how those approvals are checked, and how often.

Scale is contested. Confiant noted that the Candiru-linked ads were a tiny fraction of Discover-Tech's total volume, according to Calcalist Tech. That cuts two ways. The spyware-linked share was small, but a small share of a network that serves that many sites still reached targets.

Reuters could not reach Candiru's owners for comment. Discover-Tech's own response was not found in the sources reviewed.

How this compares with earlier spyware cases

Mercenary spyware has usually required a lure or a flaw. Phishing links ask a target to tap, and exploit chains target software that has not been patched. In the AdFection model, the lure is the ad slot itself, and the vendor selects its target before the user does anything at all.

That moves the defensive burden. Users can learn to spot phishing and install updates, but they have little visibility into which ad networks serve the content on a page. The defense has to come from the ad supply chain: platforms, publishers and the companies that approve vendors.

USA 24 has covered a different kind of long intrusion. Our report on the China-linked Armory Castle group describes how it exploited a BeyondTrust zero-day for seven weeks. That case turned on a software flaw rather than an ad, but both show how long a hidden foothold can last.

What US readers can do now

The first-stage exploit has not been captured, so no vendor has published a specific fix for this path. General steps still reduce risk, and several apply to individuals and organizations alike.

• Install operating system and browser updates on phones, tablets and laptops as soon as they arrive. Updates close known exploit paths, even though this particular one remains unidentified.
• Run a reputable ad blocker in your browser, and avoid installing software that a page or pop-up asks for.
• Watch for unexpected security alerts, unfamiliar apps, or a device that drains its battery or runs hot for no clear reason.
• If the phone is a work device, report unusual behavior to your IT or security team rather than trying to clean it yourself.
• Organizations should review ad-tech vendors in their supply chain, check whether each vendor appears on approved lists, and block suspicious ad domains at the network or DNS level.

Patching still matters across the board. CISA has flagged a Fortinet flaw as exploited, a reminder that known weaknesses stay in use after disclosure.

What to watch next

Several answers are still missing. Discover-Tech has not been reported to respond, Google and Comcast have not said what they will change, and it is not yet known whether US agencies or Congress will act.

The most useful next step would be a fuller technical account of the browser or app exploit. That would give security teams detection signatures and tell users which software versions matter, something the current reporting cannot do.

The ad industry's test is whether it can screen buyers before a script runs on someone's device. The open question is how many other ad networks rely on similar server-side filters, and how many devices passed through one without anyone noticing.