Online ads delivered zero-click Candiru spyware to devices
Candiru spyware infected devices at Al Jazeera through targeted online advertisements that required no click or other action from the user, according to the Citizen Lab at the University of Toronto. The malicious process began as soon as an advertisement loaded, including in cases where the placement appeared outside the visible part of a page or ran in the background. Citizen Lab describes the cases as the first public technical confirmation of mercenary spyware, commercial hacking software sold to governments, reaching real devices through targeted advertising.
The researchers recovered the installed spyware from one device, but they did not obtain the exploit, the code that takes advantage of a software weakness to gain initial access through a browser or app. As a result, the first stage of the intrusion is reconstructed from the delivery setup and network activity rather than from captured exploit code. Citizen Lab attributed the attacks to Candiru with high confidence, but did not identify which government was behind the operation.
The advertisements were placed by Discover-Tech, an Israeli company presenting itself as a conventional digital advertising business. Citizen Lab found that each placement contained a small script that returned the device's advertising ID, a number used to recognize a phone or computer for advertising, and its IP address, its address on the internet, to a Discover-Tech server. That server checked whether the device matched a selected target. A match received code for the browser or app to run, while other devices received nothing. The harmful component therefore did not have to be stored inside the advertisement delivered by the ad network, limiting what those networks could identify by inspecting the ad itself.
Citizen Lab says at least 45 Al Jazeera devices were targeted during 2024 and 2025. Traffic logs provided by the network showed a repeated sequence on infected devices: a connection to a Discover-Tech advertising server, followed by contact with a Candiru screening server and then a command-and-control server, which is infrastructure used to operate spyware on a compromised device. Al Jazeera also recovered a Windows program file from one affected system. Citizen Lab found that it used distinctive techniques matching a Candiru tool the research group had analysed in 2021, supporting the high-confidence attribution.
The news organisation had faced a separate spyware incident before. In 2020, dozens of its journalists' iPhones were compromised with NSO Group's Pegasus in an operation that used a different infection method. The latest findings concern Candiru and the advertising delivery channel, rather than a continuation of that earlier operation.
Discover-Tech had been listed as an approved advertising vendor by Google and the trade organisation IAB Europe from 2020 until the month of the disclosures. The company was registered in Israel in 2020. After Citizen Lab shared its findings, Google and IAB Europe removed it from their vendor lists in early October. Google also ended its access to the company's ad exchanges, Beeswax removed it, Vungle paused access while conducting a review, and Eskimi blocked its accounts. Google told Reuters that the removal followed systematic policy violations, while IAB Europe cited violations identified through an audit. Comcast, the owner of Beeswax, said its action followed recent activity.
Candiru was added to a United States trade blacklist in 2021 over spyware used against government officials, journalists and activists. In 2025, its assets were purchased by the US investment firm Integrity Partners and transferred to a new company reported to be Integrity Labs, which is not covered by the sanctions. Discover-Tech, Candiru's owners, Al Jazeera and the Russian advertising network Yandex did not respond to Reuters. Discover-Tech's website remained available on Thursday without addressing the research.
The advertising operation had substantially wider reach than the confirmed cases. Citizen Lab says Discover-Tech submitted nearly four billion ad bids, offers to display an advertisement, through one platform between March and June 2026. Placements containing the callback script appeared in approximately 75,000 mobile apps and 120,000 websites. Confiant, a US advertising-security company that investigated with Citizen Lab, estimated Discover-Tech's volume at about 10 million advertisements per day.
Citizen Lab observed the advertisements on networks belonging to NATO, the United Nations, European Union bodies, government offices in about two dozen countries, semiconductor manufacturers and news organisations. That does not establish that devices on those networks were infected. It demonstrates the system's possible reach. Confiant found that the small set of advertisements it could connect directly to Candiru ran at low volume and mostly reached residential and mobile internet connections rather than the sensitive institutional networks themselves.
Citizen Lab and Confiant published domains and files associated with the campaign so defenders can block known infrastructure and search historical records. The indicators include the Discover-Tech server domain mtrtb[.]com and the SHA-256 value 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8 for the recovered spyware. SHA-256 is a digital fingerprint used to identify an exact file. Confiant's report contains the broader list, including command-and-control servers. Defenders can also look for the reported connection sequence, while recognising that an advertisement appearing on a website or network does not by itself prove compromise.
The findings are relevant to website operators because legitimate advertising placements can become an initial delivery path without the website itself necessarily being compromised. Security researchers had previously warned that automated ad buying could be used in this way. Leaked documents in December connected spyware maker Intellexa with a similar advertising-based tool called Aladdin, although no live infection through that system had been demonstrated. Organizations reassessing their wider security posture can use AEU-I for security-first IT, infrastructure and consulting.
For businesses and IT teams, the central issue is that ordinary-looking advertising traffic may need to be considered during incident investigations, particularly when protecting journalists or other people at heightened risk. Updates and reduced exposure to third-party advertising remain practical precautions, but the report does not identify the unrecovered exploit or establish that every device exposed to these advertisements was attacked.