Candiru spyware hit Al Jazeera via zero-click online ads

Israeli spyware maker Candiru infected devices at the news network Al Jazeera through ordinary online ads that required no click or action from the user, according to researchers at the Citizen Lab. The hidden attack code executed the moment an ad loaded on screen, and in some cases the ad loaded out of sight in the background.

The Citizen Lab, a research group at the University of Toronto, said this is the first public technical confirmation that mercenary spyware has reached real devices through targeted ads, as the researchers described. The ads were placed by Discover-Tech, an Israeli company that presents itself as a normal digital advertising firm.

Each ad carried a small piece of code that quietly sent the device’s advertising ID and internet address back to a Discover-Tech server, which then decided whether to deliver attack code. At Al Jazeera, at least 45 devices were targeted in 2024 and 2025, and the Citizen Lab linked the attacks to Candiru with high confidence.

Al Jazeera pulled one Windows program file from a compromised device, and its code used the same distinctive techniques as a Candiru tool the Citizen Lab analyzed in 2021, according to their previous research. The United States put Candiru on a trade blacklist in 2021 over spyware used to target government officials, journalists, and activists, as the Commerce Department announced.

After the researchers shared their findings, Google and IAB Europe removed Discover-Tech from their vendor lists in early October, the Citizen Lab said. Google told Reuters it removed Discover-Tech “for systematically violating our policies.”

Discover-Tech’s reach went far beyond Al Jazeera, placing nearly four billion ad bids between March and June 2026 across roughly 75,000 phone apps and 120,000 websites, according to the Citizen Lab. Confiant, a U.S. ad-security firm that investigated alongside the Citizen Lab, put Discover-Tech’s traffic at roughly 10 million ads a day, as detailed in their report.

Both groups published the web addresses and files associated with the operation so defenders can block them and search their own records. Security researchers have warned for years that the ad-buying system could be turned to this use.

✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.

Previous Articles:

• Mastercard and BVNK Launch Global Money Platform
• FBI helps dismantle crypto scam targeting Russian speakers
• Tron files $200M ATM offering to fund TRX purchases
• Critical Drupal Field UI RCE: Patch Now, Uninstall Module
• Musk Praises Micron Memory Pricing, Boosts MU Stock Forecast