Targeted Ad Spyware: How Candiru Infected Al Jazeera Devices Through Ordinary Adverts

Targeted ad spyware stopped being a rumour this week. Citizen Lab, a research group at the University of Toronto, published the first public technical proof that an ordinary online advert can infect a device with mercenary spyware. No click, no download, no lure.

The victims were at Al Jazeera. Citizen Lab says at least 45 of the broadcaster’s devices were targeted in 2024 and 2025 with spyware from Candiru, an Israeli vendor that sells to governments.

How targeted ad spyware reached Al Jazeera

The ads were bought by Discover-Tech, an Israeli company registered in 2020 that presented itself as a normal ad business. Citizen Lab links the Al Jazeera attacks to its ads with high confidence. Its report, which it calls AdFection, says the simple display of a targeted ad was enough for infection.

The evidence comes from Al Jazeera’s own network logs. They show the same sequence each time: a Discover-Tech ad server, then a Candiru screening server, then a command-and-control server, which is simply the machine attackers use to send orders to infected devices. A Windows program recovered from a compromised device also matched techniques in a Candiru tool that Citizen Lab analysed in 2021.

One gap matters. The researchers recovered the spyware, but not the browser or app exploit that let it in. That step is inferred from how the attack was built. Confiant, an ad security firm that studied the same operation, also says it did not capture exploit delivery in the wild.

How a harmless-looking ad becomes a delivery route

The design is clever. The ad itself contains nothing malicious. Each ad carried a small script that sent the device’s advertising ID and IP address to a Discover-Tech server. That server decided whether the device was a target. Only targets received attack code. Everyone else got nothing.

That explains why ad networks missed it. A scanner that checks for bad code finds only a tracking call. Confiant describes a hidden one-pixel frame that loaded an obfuscated toolkit, which then fingerprinted the device and waited for instructions from a remote server.

Citizen Lab also describes Controlium, the platform Discover-Tech used. A customer can pick targets by advertising ID, browser ID or IP address. It can also trigger code when an ad renders. The researchers found some of the company’s login records exposed online. That is an odd slip for a firm doing surveillance work.

How big is the ad route?

Citizen Lab analysed about 4 billion ad bids placed between March and June 2026 on one platform. Ads carrying the callback code appeared in roughly 75,000 apps and 120,000 websites. Confiant estimates around 10 million ads a day.

The ads also showed up on networks tied to NATO, the UN, EU bodies and government offices in about two dozen countries. That does not mean anyone there was infected. Confiant found that the ads it could tie to Candiru were low in volume and mostly reached home and mobile connections.

Google and IAB Europe both listed Discover-Tech as an approved vendor from 2020. After the findings, Google removed it for “systematically violating our policies”, according to Reuters coverage. IAB Europe suspended it, and Comcast’s Beeswax, Vungle and Eskimi cut its access.

What targeted ad spyware means for a UK business

Most firms are not Al Jazeera, and nobody should panic. Mercenary spyware is expensive and aimed at a short list of people. But the delivery method does not care who owns the browser. Targeted ad spyware needs only an ad slot and a vulnerable device. If your staff browse the open web, your organisation sits in the same ad ecosystem.

The people most at risk are the ones attackers actually pick: senior executives, finance leads, journalists, lawyers and anyone dealing with sensitive negotiations. Three practical steps follow.

• Keep browsers, operating systems and phone software patched. The attack relied on an exploit, and updates are what close those. Our piece on why the patch always comes too late covers the gap.
• Give high-risk staff stricter settings, such as an ad blocker enforced by policy and Lockdown Mode on Apple devices.
• Review the scripts your own sites load. If you run ads or third-party tags, security testing should cover them.

Browser add-ons are another soft spot, as we saw with the StegoAd campaign. An enforced ad blocker helps here, but only from a vetted source.

Reuters reports that Discover-Tech did not respond to requests for comment. Citizen Lab’s Wolfie Cristl called online advertising a “systemic security threat” to states, businesses and civil society alike. That is a strong claim. The Al Jazeera logs give it some weight.

Citizen Lab did not name the government behind the Al Jazeera operation. Candiru was put on a US trade blacklist in 2021. In 2025 its assets were bought by a US investment firm and moved to a new company, which the sanctions do not cover. The ad route it used is now exposed, and the platforms have reacted. Will the next vendor build it again under a new name? That is the open question for targeted ad spyware.