Citizen Lab links Israeli ad firm to Al Jazeera hacks

Researchers say an Israeli advertising company turned ordinary online ads into a delivery system for government-grade spyware, and that it was used to hack devices at the Qatari broadcaster Al Jazeera. The University of Toronto's Citizen Lab published the report Thursday, October 15. It calls the technique "AdFection" and describes it as "the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads". Citizen Lab said it linked, "with high confidence," attacks on at least 45 devices at Al Jazeera in 2024 and 2025 to spyware made by Candiru and delivered through ads from Discover-Tech.reuters.com

How the attacks worked

Discover-Tech runs a platform called Controlium that lets its spyware partners identify people, fingerprint their devices and infect them automatically the moment an ad loads. Victims did not have to click anything. They only had to visit a website on a vulnerable computer and see the ad. Citizen Lab said it could confirm that 45 Windows devices were compromised because Al Jazeera shared its network logs. The 72-page report says Candiru was renamed Integrity Labs after a U.S. company bought it. The U.S. Commerce Department blacklisted Candiru in 2021. The researchers said a second spyware maker, Bindecy, also used the platform.reuters.com+4

Ads reached nearly 200,000 sites and apps

The researchers analyzed about four billion ad-bidding records. They found Discover-Tech's ads ran on almost 200,000 websites and Android and iOS apps over four months. Jerome Dangu, cofounder of the ad security firm Confiant, said the company sent out at least 10 million ads a day and that "very likely hundreds of millions of people would have been touched by Discover-Tech". Confiant found the ads on networks at the Pentagon, the International Atomic Energy Agency and the International Criminal Court. However, it said seeing an ad on a network does not mean that organization was targeted.nbcnews.com+2

Ad industry cuts ties

Google Alphabet Inc. ↘ 2.32% said it helped with the investigation and removed Discover-Tech from its ad platforms "for systematically violating our policies." IAB Europe said it suspended the firm from its list of approved vendors last week after an audit found policy violations. Comcast ↗ 0.60% said its ad tech subsidiary Beeswax removed Discover-Tech "following recent activity". The ad companies Vungle and Eskimi also cut ties with the firm. Discover-Tech, its chief executive Dekel Boni, and Al Jazeera did not respond to requests for comment.reuters.com+1

Citizen Lab has reported on spyware attacks against Al Jazeera before. Its earlier research found that 36 Al Jazeera journalists and staff had their phones hacked with NSO Group's Pegasus spyware.nbcnews.com

"The way online advertising works today is a systemic security threat," said Citizen Lab researcher Wolfie Christl.reuters.com