A report by the Citizen Lab confirms a zero-click spyware operation linked to Candiru targeted Al Jazeera and other organisations through online advertising. The researchers found that the attack ran as soon as an advertisement loaded, with some callbacks occurring in the background, and that no user interaction was required to initiate the compromise.
They recovered a Candiru spyware sample from one device and tied the operation to Candiru with high confidence, although the exact exploitation flow into the browser or app was not captured in code. The attack is described as the first public, technical confirmation that mercenary spyware can reach real devices via targeted ads.
Evidence and scope indicate a wide reach beyond Al Jazeera. Discover-Tech, an Israeli ad vendor, placed ads that included a lightweight beacon. The device’s advertising ID and IP address were sent to Discover-Tech, which then fate-tested targets and dispatched attack code to those devices. The targeting sequence observed on infected devices was consistent: Discover-Tech ad server contact, Candiru screening, then a command-and-control server that runs the spyware.
Al Jazeera reportedly experienced at least 45 targeted devices across 2024–2025, with links to the Candiru toolkit used in a similar fashion to a known Candiru operation. Notably, a Windows executable recovered from one device shared techniques seen in Candiru’s 2021 tooling (as previously dissected by the Citizen Lab).
Defence and response details are explicit. Google and IAB Europe removed Discover-Tech from vendor lists in early October; Google also cut off Discover-Tech from its ad exchanges. Confiant’s independent investigation estimated Discover-Tech’s traffic at around 10 million ads per day, with a reach that touched government bodies, NATO, the UN, EU institutions, chipmakers, and major media.
Defenders are advised to review publicly published indicators, including the SHA-256 sample 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8 and the Discover-Tech ad server domain mtrtb[.]com, and to monitor for the characteristic sequence of communications: ad server → Candiru screening node → command-and-control.