Israeli ad firm Discover-Tech used online ads to plant spyware on Al Jazeera devices

What the researchers found

Citizen Lab, a research unit at the University of Toronto, published a report on Thursday, 15 October, saying that Discover-Tech, an Israeli company that calls itself an advertising agency, bought online ads with spyware built in. Those ads sent devices to servers linked to Candiru, a spyware maker the US government blacklisted in 2021. Citizen Lab called it the earliest known case of zero-click targeted advertising, meaning the target does not have to open a link or take any other step for the infection to happen. The investigation grew out of Al Jazeera's own probe. Its internal technology team first noticed unusual patterns on some journalists' devices in 2024, and the pattern continued into 2025.

The network asked Citizen Lab for a detailed look, and the researchers analyzed network logs that Al Jazeera provided from the attack period. They counted at least 45 devices at the Qatar-based broadcaster that were targeted in 2024 and 2025. Millions of devices were pointed to the malware, including several belonging to Al Jazeera journalists who covered sensitive subjects. Researchers stressed that being directed to the malware does not mean every device was infected.

1. 2024Al Jazeera's internal technology team first notices unusual patterns on some journalists' devices
2. 2025The unusual patterns continue on Al Jazeera devices
3. Oct 15, 2026Citizen Lab publishes its report on Discover-Tech and Candiru

How the ad platform worked

Discover-Tech runs a platform called Controlium, which, according to the report, lets its spyware partners profile people precisely, fingerprint their devices and select a person for infection by IP address, mobile ad ID or browser identifier. Citizen Lab said at least two zero-click spyware makers, Candiru and Bindecy, used the platform to find targets. The technique relies on real-time bidding, the automated system that platforms such as Google use to sell ad space, so a victim can be reached without interacting with anything.

An analysis of four billion advertising records found Discover-Tech ads on nearly 200,000 websites and mobile apps in dozens of countries over four months. Some of those sites were institutional pages of NATO, the United Nations, the European Parliament, the European Commission and the Council of the EU. Citizen Lab also says the company has served ads to millions of users worldwide since 2024, including people in Yemen, Brazil, Mexico and Czechia.

Other findings and industry responses

Confiant, a New York-based security firm, said in a separate report that some Discover-Tech ads also appeared on networks used by the Pentagon, the International Atomic Energy Agency and the International Criminal Court. Google and Beeswax, the Comcast-owned advertising company, have removed Discover-Tech from their platforms, and IAB Europe suspended the company from its list of approved vendors, Reuters reported. Discover-Tech and Integrity Labs did not immediately respond to requests for comment, and POLITICO reported that Integrity Labs acquired Candiru in 2025. Citizen Lab said it was unclear which governments were behind the attacks.

Warnings and reaction

Al Jazeera Media Network condemned the targeting of devices belonging to several of its employees with spyware, said it had cooperated voluntarily with the researchers and called on those responsible to be held accountable. It described targeting journalists as an assault on press freedom and the public's right to knowledge.

Bill Marczak, a senior researcher at Citizen Lab, put the risk in stark terms.

Plugging into the online ads ecosystem provides the mercenary spyware industry a stealthy delivery system.

Wolfie Christl, another Citizen Lab researcher, said it was disastrous that major ad vendors and organisations failed for years to detect or prevent the company's operations.

The way the online advertising ecosystem works today is a security threat for states, the private sector, civil society and everyone else alike.

Researchers recommend that users at high risk of targeting use ad blockers, disable ad tracking and regularly reset their mobile ad IDs, and they urge the advertising industry to tighten security on its platforms.