Zero-Click Spyware Delivered Through Online Ads Found on Al Jazeera Devices

Researchers at the Citizen Lab, a research group at the University of Toronto, say Israeli spyware maker Candiru infected devices at the news network Al Jazeera through ordinary online ads. The attacks needed no click or other action from the user. The hidden code ran the moment an ad loaded, and sometimes the ad loaded out of sight in the background. The Citizen Lab calls this the first public, technical confirmation that mercenary spyware, meaning hacking tools sold to governments, has reached real devices through targeted ads.

The ads were placed by Discover-Tech, an Israeli company that presents itself as a normal digital advertising firm. Each ad quietly sent the device's advertising ID and internet address to a server, which decided whether the device belonged to a target. If it did, the server sent back attack code. If not, it sent nothing. Because the ad carried no attack code itself, the ad networks delivering it had nothing harmful to detect.

At least 45 Al Jazeera devices were targeted in 2024 and 2025. The Citizen Lab linked the attacks to Candiru with high confidence, partly because a Windows file taken from a compromised device used the same techniques as a Candiru tool it analysed in 2021. The researchers recovered the spyware but not the exploit that breaks into the browser or app, and they did not say which government was behind the operation. Al Jazeera staff were also targeted in 2020, when NSO Group's Pegasus spyware was used on journalists' iPhones.