Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that needed no click or other action from the user, researchers at the Citizen Lab said Thursday.
The hidden attack code ran the moment an ad loaded on the screen, and in some cases the ad loaded out of sight, in the background.
The Citizen Lab, a research group at the University of Toronto, said this is the first public, technical confirmation that mercenary spyware, meaning hacking tools sold to governments, has reached real devices through targeted ads. The method had been described before from leaked company documents, but not shown in a live attack.
The researchers recovered the spyware itself from one device, but not the exploit that breaks into the browser or app to install it. That first break-in step is described from how the attack was set up, not from captured code.
How the Attack Worked
The ads were placed by Discover-Tech, an Israeli company that presents itself as a normal digital advertising firm. Each ad carried a small piece of code that, when the ad loaded, quietly sent the device’s advertising ID and internet address back to a Discover-Tech server, the researchers found.
That server decided whether the device belonged to a target. If it did, the server sent back attack code for the browser or app to run. If it did not, the server sent nothing. Because the ad itself carried no attack code, the ad networks that delivered it had nothing harmful to detect.
At Al Jazeera, at least 45 devices were targeted in 2024 and 2025, the Citizen Lab said, and it linked the attacks to Candiru with high confidence. The researchers did not say which government was behind the operation.
The network gave the researchers its traffic logs. On infected devices, the logs showed the same order each time: first contact with a Discover-Tech ad server, then a Candiru server that screens the device, then a command-and-control server that runs the spyware.
Al Jazeera also pulled one Windows program file off a compromised device. Its code used the same distinctive techniques as a Candiru tool the Citizen Lab took apart in 2021, which is the basis for the high-confidence link.
Al Jazeera staff were targeted once before. In 2020, dozens of its journalists’ iPhones were hacked with NSO Group’s Pegasus spyware, in a different operation that used a different method.
Who Discover-Tech and Candiru Are
Google and the advertising trade group IAB Europe had both listed Discover-Tech as an approved ad vendor from 2020 until this month. The company was registered in Israel in 2020 and is led by its chief executive, Dekel Boni.
Candiru is one of the better-known names in the spyware trade. The United States put it on a trade blacklist in 2021 over spyware used to target government officials, journalists, and activists. In 2025, its assets were bought by a U.S. investment firm, Integrity Partners, and moved into a new company, reported to be Integrity Labs, that the sanctions do not cover.
What the Platforms Did
After the researchers shared their findings, Google and IAB Europe removed Discover-Tech from their vendor lists in early October, the Citizen Lab said. Google cut off the company’s access to its ad exchanges, Beeswax removed it, Vungle paused its access for a review, and Eskimi blocked its accounts.
Google told Reuters it had worked with the researchers and removed Discover-Tech “for systematically violating our policies.” IAB Europe said it suspended the company after an audit found policy violations. Comcast, which owns Beeswax, said it acted “following recent activity.”
Discover-Tech, Candiru’s owners, Al Jazeera, and the Russian ad network Yandex did not respond to Reuters. Discover-Tech’s website was still online on Thursday and said nothing about the findings.
How Far the Ads Reached
Discover-Tech’s reach went far beyond Al Jazeera. On one of its platforms, the company placed nearly four billion ad bids between March and June 2026, the Citizen Lab said, and the ads carrying the hidden callback code appeared in about 75,000 phone apps and 120,000 websites.
Confiant, a U.S. ad-security firm that investigated alongside the Citizen Lab, put Discover-Tech’s traffic at roughly 10 million ads a day.
The ads turned up on the networks of governments and large institutions, the Citizen Lab said, including NATO, the United Nations, European Union bodies, government offices in about two dozen countries, chipmakers, and news organizations. An ad appearing on a network is not proof that anyone there was infected. It shows only how widely the system could reach.
Confiant found that the small number of ads it could tie directly to Candiru were low-volume and mostly reached home and mobile internet connections, rather than the sensitive networks themselves.
What Defenders Can Check
Both groups published the web addresses and files associated with the operation, so defenders can block them and search their own records. Organizations whose staff may have seen the ads, especially on the networks named in the report, can look for the attack’s order of connections: a device reaching a Discover-Tech ad server, then a Candiru screening server, then a command-and-control server.
Among the published indicators:
- SHA-256 (recovered spyware sample): 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8
- Domain (Discover-Tech ad server): mtrtb[.]com
- Full list: the indicators in Confiant’s report, including the command-and-control servers.
Security researchers have warned for years that the ad-buying system could be turned to this use. In December, leaked documents tied the spyware maker Intellexa to a similar ad-based tool called Aladdin, though no live infection through it had been shown.
