Citizen Lab Links Al Jazeera Hacks to Zero-Click Spyware Delivered via Online Ads

Security researchers at the University of Toronto’s Citizen Lab published a report on Thursday detailing how mercenary spyware infected dozens of devices at Al Jazeera. The investigation confirms that attackers used targeted online advertisements to deliver zero-click exploits, allowing spyware to install silently without any action from the victims. This finding provides the first concrete technical evidence of such attacks being executed through global advertising networks.

The researchers identified Discover-Tech, an Israeli company that presents itself as a legitimate digital advertising firm, as the delivery mechanism. According to the report, Discover-Tech acts as a bridge between ad vendors and the spyware ecosystem. At least two spyware makers, Candiru and Bindecy, utilized this platform to target specific individuals or devices worldwide. The ads contained code that sent device identifiers to a server, which then decided whether to deliver the exploit.

How the Attack Mechanism Works

The Citizen Lab explained that the ads themselves did not contain the attack code, which allowed them to bypass detection by ad networks. When an ad loaded on a screen, even in the background, it quietly transmitted the device’s advertising ID and internet address to a Discover-Tech server. If the server determined the device was a target, it sent back the necessary attack code for the browser or app to execute. If not, the server sent nothing, leaving the ad harmless.

Traffic logs provided by Al Jazeera showed a consistent sequence of events on infected machines. The logs recorded initial contact with a Discover-Tech ad server, followed by a connection to a Candiru server that screened the device. Finally, the device connected to a command-and-control server that managed the installed spyware. The researchers recovered the spyware from one device but did not capture the initial exploit code, relying instead on the attack setup and distinctive coding techniques to link it to Candiru.

Impact on Al Jazeera and Historical Context

The Citizen Lab linked the infections to Candiru with high confidence, noting that the recovered Windows program file used techniques similar to a Candiru tool the lab analyzed in 2021. The attacks affected at least 45 Windows computers at the media organization during 2024 and 2025. While the researchers did not identify which specific governments commissioned the operation, they noted that Candiru sells its surveillance products to government clients.

This incident marks a significant escalation in the use of malvertising for state-sponsored surveillance. Previous methods for targeting journalists at Al Jazeera included the 2020 Pegasus spyware campaign, which infected dozens of iPhones using different techniques. The current report highlights how advertising networks, designed to help advertisers reach specific demographics, can be abused to target individuals with pinpoint precision. Bill Marczak, a senior researcher at Citizen Lab, stated that while there had been buzz about this capability, this report offers the first proof of the process in action.

What should you do?

Organizations should monitor network traffic for connections to unknown advertising servers or domains associated with mercenary spyware distributors. Security teams should review logs for unusual sequences of connections that follow ad loading events, particularly those involving background processes. Administrators should ensure that endpoint detection and response tools are updated to identify known spyware artifacts, such as those linked to Candiru. Users should remain aware that simply loading a webpage with ads can potentially trigger surveillance tools, emphasizing the need for robust network-level filtering.

Background: Endpoint detection and response (EDR)

Endpoint detection and response examples include blocking PowerShell scripts that download payloads, isolating devices showing abnormal memory access, and rolling back file changes. These tools monitor behavior, not just signatures, to stop advanced threats that evade standard security controls.

Read the full guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats

What to do and how to stay safe: Candiru

• Monitor network traffic logs for connections to advertising servers that precede connections to known spyware command-and-control infrastructure.
• Review endpoint security alerts for unusual browser or app behavior that occurs immediately after ad content loads, even in the background.
• Implement strict allow-listing for trusted advertising domains to reduce the attack surface for malvertising campaigns.
• Once the vendor provides an update, apply patches to browsers and operating systems to mitigate known zero-click vulnerabilities.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did the attackers need users to click on the ads to install the spyware?

No, the Citizen Lab confirmed these were zero-click attacks where the spyware installed automatically when the ad loaded, without any user interaction.

Which company provided the platform used to deliver the spyware?

The attacks used Discover-Tech, an Israeli advertising platform that researchers say serves as a bridge for mercenary spyware makers.

How many devices at Al Jazeera were affected by this specific campaign?

The researchers found evidence that at least 45 Windows computers at Al Jazeera were infected during 2024 and 2025.