Citizen Lab traces Al Jazeera zero-click Candiru spyware infections to targeted online ads

Citizen Lab says Israeli spyware vendor Candiru infected Al Jazeera devices through ordinary online ads, with the attack requiring no user click or any action, and at least 45 devices targeted between 2024 and 2025. Researchers say the ads were placed by Discover-Tech, which describes itself as a digital advertising company; when an ad loads, the device's advertising ID and network address are sent back to its server, which determines whether the device is a target and whether to deliver attack code. The ad itself contains no malicious content, so the ad networks that served it had nothing detectable. They recovered a spyware sample from one device whose code techniques match the Candiru tool dismantled in 2021, and on that basis linked it to Candiru with high confidence; the research does not say which government was responsible. Google and IAB Europe removed Discover-Tech from vendor lists in early October, Google cut off its ad exchange access, Beeswax removed it, and Vungle suspended its access pending review.