Citizen Lab Connects Candiru Intrusions at Al Jazeera to Online Ads
Citizen Lab has linked zero-click Candiru spyware infections affecting Al Jazeera devices to targeted online advertising. The University of Toronto research group said at least 45 devices at the news network were targeted in 2024 and 2025, and that the hidden attack code could execute as soon as an advertisement loaded, including when an ad loaded in the background.
The researchers described the case as the first public technical confirmation that mercenary spyware sold to governments had reached real devices through targeted advertisements. Citizen Lab recovered the spyware from one compromised Windows device, although it did not obtain the exploit used for the initial browser or application compromise.
Advertising infrastructure used for target selection
The advertisements were placed by Discover-Tech, an Israeli company that presents itself as a digital advertising firm. Citizen Lab found that each ad contained code that sent a device advertising identifier and internet address to a Discover-Tech server. That server determined whether the device was a selected target.
For a selected device, the server returned attack code for the browser or app to process. For other devices, it returned nothing. This separation meant the delivered ad did not itself contain attack code, leaving ad networks without a harmful payload to identify at the point of delivery.
Traffic logs supplied by Al Jazeera showed the same sequence on infected devices: a connection to a Discover-Tech ad server, followed by a Candiru server that screened the device, and then a command-and-control server used by the spyware. Citizen Lab linked the operation to Candiru with high confidence because the recovered Windows sample used distinctive techniques matching a Candiru tool the group analysed in 2021. The researchers did not attribute the operation to a government.
Platform removals and the scale of distribution
Google and IAB Europe had listed Discover-Tech as an approved ad vendor from 2020 until early October. After Citizen Lab shared its findings, both removed the company from their vendor lists. Google also cut off Discover-Tech's access to its ad exchanges, while Beeswax removed it, Vungle paused its access for review and Eskimi blocked its accounts.
Google told Reuters that it removed Discover-Tech for systematically violating its policies. IAB Europe said an audit had found policy violations. Discover-Tech, Candiru's owners, Al Jazeera and the Russian advertising network Yandex did not respond to Reuters.
The potential delivery footprint was much larger than the confirmed Al Jazeera targeting. Citizen Lab said Discover-Tech placed nearly four billion ad bids on one platform between March and June 2026, and ads carrying the callback code appeared in about 75,000 mobile apps and 120,000 websites. Confiant, which investigated alongside Citizen Lab, estimated the company's traffic at roughly 10 million ads daily.
The researchers cautioned that an ad appearing on a network does not demonstrate an infection. Although the ads were seen on networks associated with governments, major institutions, chipmakers and news organisations, Confiant found that the small number tied directly to Candiru were low-volume and mostly reached home and mobile connections.
What security teams can investigate
Citizen Lab and Confiant published domains, files and other indicators connected with the operation. One published SHA-256 value for the recovered spyware sample is 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8, and the identified Discover-Tech ad-server domain is mtrtb[.]com.
For organisations reviewing their records, the practical indicator is the ordered chain identified in Al Jazeera's logs: contact with a Discover-Tech ad server, then a Candiru screening server, then command-and-control infrastructure. Teams can use the published indicators to block known infrastructure and search network telemetry for that sequence, particularly where staff may have encountered the advertising delivery path.