Published Updated

Technology and Scienceupdated 19m ago2 min read

Citizen Lab Says Discover-Tech Delivered Candiru Zero-Click Spyware via Targeted Ads to Al Jazeera

This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.

Discover-Tech used a vast ad network to track users and enable spyware deployment. Zero-click spyware infection via online ads without interaction, dubbed AdFection, targeted Al Jazeera devices.

Read the story
Citizen Lab Says Discover-Tech Delivered Candiru Zero-Click Spyware via Targeted Ads to Al Jazeera
Image: Ynetnews

AdFection targets Al Jazeera

Citizen Lab identified “AdFection,” a technique in which the simple display of a targeted ad was enough for infection, and Citizen Lab said it was the first technical demonstration of zero-click mercenary spyware delivered via targeted advertisements. Citizen Lab showed how Discover-Tech, while purporting to be a legitimate advertising company, appeared to be a front for large-scale ad espionage abuse, including the automatic delivery of mercenary spyware when ads were displayed to a target.

Citizen Lab confirmed that a powerful form of Candiru spyware delivered through Discover-Tech’s ads had been used to compromise 45 Windows devices at the Qatari broadcaster Al Jazeera between 2024 and 2025. Al Jazeera “condemns the spyware attacks targeting a number of its staff” and said it was taking steps to protect its employees and its systems.

Image from Aarabi21
Image: Aarabi21
Reporting for this sectionThe Citizen LabHaaretz

Industry cuts access

Google said it had collaborated with Citizen Lab and Confiant’s investigation and kicked Discover-Tech off its ad platforms for “systematically violating our policies.” Confiant cofounder Jerome Dangu said Discover-Tech was pumping out at least 10 million ads per day all around the world, and he said data-sharing arrangements called cookie matching allowed it to track people even beyond the reach of its advertisements.

IAB Europe said in an email that it suspended Discover-Tech from its list of globally approved vendors last week after an audit identified policy violations. Comcast said its ad tech subsidiary Beeswax removed Discover-Tech from its platform “following recent activity,” while Yandex did not return Reuters messages seeking comment.

Image from Al Jazeera
Image: Al Jazeera
Reporting for this sectionHaaretzThe National

A global security risk

Al Jazeera’s spokesperson described the targeting of its staff as “a deliberate attack on journalists and on press freedom,” and the network said it was calling for “a full, independent investigation to identify those responsible and hold them to account.” Wolfie Christl, a senior researcher at Citizen Lab, told Reuters that “The way online advertising works today is a systemic security threat,” and he said it affected “For states, the private sector, civil society and everyone else alike.”

“It's global espionage that we've uncovered on a massive scale.”
CBC

The Committee to Protect Journalists “The mass surveillance architecture supporting online advertising is being harnessed for other purposes and puts journalists at risk,” and it called on Israeli and other relevant authorities to investigate and hold to account those responsible. Confiant said its investigation found “the weaponization of ad infrastructure for advanced staging, preliminary targeting, and payload delivery,” and it said the operation used advertising infrastructure for covert surveillance that could evade detection.

Reporting for this sectionMuslim Network TVCBC