Technology, Surveillance, Press Freedom & Privacy
Researchers trace zero-click ad spyware to 45 Al Jazeera devices
Citizen Lab and Confiant say Discover-Tech used online advertising infrastructure for mass tracking and targeted Candiru spyware delivery. The researchers confirmed compromise of 45 Al Jazeera Windows devices, while broader ad exposure does not prove infection.
Network logs tied 45 Al Jazeera devices to a zero-click attack chain
Citizen Lab reported on October 15 that at least 45 Windows devices within Al Jazeera were targeted and infected in 2024 and 2025 with mercenary spyware it linked with high confidence to Candiru, now known as Integrity Labs. The lab said Al Jazeera supplied network logs showing a repeated sequence: a Discover-Tech ad impression, contact with a Candiru validator server and then further profiling and infection. The attack required no click because the malicious code could execute when a selected advertisement rendered. [1][3][4]
Al Jazeera said it cooperated voluntarily with the researchers, condemned the targeting of staff and was taking steps to protect employees and systems. Citizen Lab's finding concerns confirmed devices inside one media organization; the reviewed material does not identify the individual users, the government customers alleged to have commissioned the attacks or the information taken from each device. [4][1][3]
The ad network's reach was much larger than the confirmed infections
Citizen Lab analyzed nearly four billion bidding records and found Discover-Tech advertisements on almost 200,000 unique websites and mobile apps during a four-month period. Confiant separately studied ad-security telemetry from April 1 through September 10 and found Discover-Tech activity across broad geographic clusters and hundreds of sensitive networks. Reuters reported that Confiant estimated at least 10 million ads a day and said hundreds of millions of people were likely touched by the company's tracking infrastructure. [1][2][3]
Those scale figures measure ad impressions, bidding records or exposure to tracking — not spyware infections. Confiant said Candiru-attributed advertisements were a tiny fraction of Discover-Tech's overall volume and appeared in campaigns ranging from hundreds to the low thousands of impressions per day. Showing an ad on a government, media or residential network also does not prove that the organization operating that network was deliberately targeted or compromised. [2][3][5]
Advertising platforms cut access after coordinated disclosure
Citizen Lab said Google terminated Discover-Tech's access to its ad exchanges, IAB Europe removed it from an approved-vendor list, Beeswax removed it from its buying platform, Vungle paused access for review and Eskimi blocked its accounts and domains. Reuters independently obtained confirmations from Google, IAB Europe and Comcast's Beeswax. These platform actions establish policy enforcement, not a court finding of criminal or civil liability. [1][3]
Discover-Tech and Candiru's owners did not respond to Reuters. The U.S. Commerce Department placed Candiru on its Entity List in 2021 over allegations that its spyware had been supplied to foreign governments and used against officials, journalists, activists and academics. The new reports call for regulatory investigation, but the reviewed record does not show a public prosecution, judgment or named state purchaser connected to the Al Jazeera compromises. [3][1][4]
How the sources compare
| Source | What it adds | Scope or limitation |
|---|---|---|
| Citizen Lab · English | The technical attribution, Al Jazeera log analysis, infection sequence, corporate links and almost four-billion-record advertising dataset. | The researchers use high-confidence attribution rather than a judicial finding and do not identify the customer behind the Al Jazeera attacks. |
| Confiant · English | Independent ad-security telemetry, the April–September observation window, regional reach and the much smaller scale of Candiru-attributed handoffs. | Its network observations show where ads landed, not that every organization or device was intentionally targeted or infected. |
| Reuters · English | Responses from advertising platforms, unsuccessful attempts to reach Discover-Tech and Candiru, and a clear distinction between mass tracking reach and spyware delivery. | The core technical findings derive from the two research investigations rather than a government or judicial inquiry. |
| Al Jazeera Arabic · Arabic, summarized in English | The newsroom's confirmation that it supplied information to researchers, its protection response and the figure of 45 affected Windows devices. | Al Jazeera is the affected organization and primarily summarizes Citizen Lab's findings; it does not independently attribute the customer behind the attacks. |
| The Guardian · English | Independent technology reporting on how the ad-delivery method could execute without victim interaction and why broad exposure differs from known compromise. | It relies heavily on the Citizen Lab and Confiant investigations and does not add a separate forensic examination. |
What remains unclear
Who purchased or directed the spyware attacks against Al Jazeera and what legal authority, if any, was claimed.
How much information was taken from each compromised device and whether additional affected organizations have confirmed infections.
Whether regulators or law-enforcement agencies will investigate Discover-Tech, Candiru or the advertising platforms that carried the ads.
How many users were merely exposed to tracking, separately targeted for profiling or actually infected with spyware.
Whether the advertising-industry removals fully cut off the infrastructure or whether the operators will reappear under other entities.
Sources & translations
- Citizen Lab, University of Toronto — Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware
- Confiant — ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming
- Reuters — Israeli firm used online ads to run vast spy operation, researchers say
- Al Jazeera Arabic — Al Jazeera condemns targeting of employees' devices with Israeli spywareNames, the 45-device figure, Windows platform, 2024–2025 period and Al Jazeera's statement were checked against the Arabic original and Citizen Lab's English report.
- The Guardian — Online ads weaponised to deliver 'zero-click' spyware, researchers say
Updates & corrections
- — Initial report separates confirmed Al Jazeera infections from the much larger population exposed to advertisements or tracking and preserves the researchers' high-confidence attribution as a technical finding rather than an adjudicated legal conclusion.