Researchers at the **Citizen Lab**, a group based at the University of Toronto, have uncovered a groundbreaking method of spyware deployment. Their findings detail how **Candiru**, a notorious Israeli purveyor of government-grade surveillance tools, utilized seemingly innocuous online advertisements to compromise devices belonging to the news network **Al Jazeera**. Crucially, these attacks were 'zero-click,' meaning the hidden exploit code ran automatically the moment an ad loaded, even if it was out of sight in the background. This marks the first public, technical confirmation of mercenary spyware reaching real devices through targeted ads, a method previously theorized from leaked documents but not observed in a live attack.  ### How the Attack Unfolded The attack vector was traced back to **Discover-Tech**, an Israeli company that presented itself as a legitimate digital advertising firm. Each malicious ad carried a small piece of code that, upon loading, silently transmitted the device's advertising ID and IP address to a **Discover-Tech** server. The server then acted as a gatekeeper: if the device matched a target profile, it delivered attack code to the browser or app. If not, no further action was taken. This clever compartmentalization meant the initial ad itself contained no harmful code, effectively bypassing detection by ad networks. **Citizen Lab** reported that at least 45 **Al Jazeera** devices were targeted in 2024 and 2025, with high confidence linking these incidents to **Candiru**. The specific government behind the operation remains undisclosed. Analysis of **Al Jazeera's** traffic logs revealed a consistent pattern: initial contact with a **Discover-Tech** ad server, followed by a **Candiru** screening server, and finally, communication with a command-and-control server that deployed the spyware. A recovered Windows program file from a compromised device exhibited distinctive techniques identical to a **Candiru** tool dissected by **Citizen Lab** in 2021, solidifying the attribution.  This isn't the first time **Al Jazeera** staff have been targeted. In 2020, numerous journalists' iPhones were compromised with **NSO Group's Pegasus** spyware, though through a different attack vector. ### The Entities Involved: Discover-Tech and Candiru **Discover-Tech**, registered in Israel in 2020 and led by CEO **Dekel Boni**, had been listed as an approved ad vendor by **Google** and the advertising trade group **IAB Europe** until this month. **Candiru** is a well-known entity in the mercenary spyware market. The United States placed it on a trade blacklist in 2021 for its role in targeting government officials, journalists, and activists. Despite sanctions, **Candiru's** assets were reportedly acquired in 2025 by U.S. investment firm **Integrity Partners** and moved into a new company, **Integrity Labs**, which is not covered by the existing sanctions. ### Platform Responses and Broader Reach Following **Citizen Lab's** disclosures, **Google** and **IAB Europe** promptly removed **Discover-Tech** from their vendor lists in early October. **Google** also severed the company's access to its ad exchanges, while other platforms like **Beeswax**, **Vungle**, and **Eskimi** took similar actions. **Google** confirmed to Reuters that it had removed **Discover-Tech** "for systematically violating our policies." **IAB Europe** stated its suspension followed an audit revealing policy violations. **Comcast**, owner of **Beeswax**, cited "recent activity" as the reason for its action.  **Discover-Tech's** reach extended far beyond **Al Jazeera**. **Citizen Lab** reported that on one platform alone, the company placed nearly four billion ad bids between March and June 2026. Ads containing the hidden callback code appeared in approximately 75,000 phone apps and 120,000 websites. **Confiant**, a U.S. ad-security firm collaborating with **Citizen Lab**, estimated **Discover-Tech's** traffic at roughly 10 million ads per day. These ads were observed on networks of governments and major institutions, including **NATO**, the **United Nations**, **European Union** bodies, government offices in dozens of countries, chipmakers, and news organizations. While an ad appearance doesn't confirm infection, it highlights the system's extensive potential reach. **Confiant's** analysis of ads directly linked to **Candiru** indicated low-volume distribution, primarily targeting home and mobile internet connections rather than sensitive organizational networks. ### Actionable Intelligence for Defenders Both **Citizen Lab** and **Confiant** have published indicators of compromise (IOCs) to aid cybersecurity professionals. Organizations whose staff may have encountered these ads, particularly those on networks mentioned in the report, should scrutinize their traffic logs for the characteristic sequence of connections: a device reaching a **Discover-Tech** ad server, followed by a **Candiru** screening server, and then a command-and-control server. Key indicators include: * **SHA-256** (recovered spyware sample): `255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8` * **Domain** (**Discover-Tech** ad server): `mtrtb[.]com` * **Full list**: The comprehensive indicators are available in **Confiant's** report, including command-and-control servers. Security researchers have long warned about the potential for ad-buying systems to be weaponized in this manner. In December, leaked documents linked spyware vendor **Intellexa** to a similar ad-based tool named **Aladdin**, though a live infection via that tool had not been previously demonstrated.