Citizen Lab: Candiru spyware infected Al Jazeera devices through targeted online ads

Researchers at the University of Toronto's Citizen Lab and ad security firm Confiant said on October 15, 2026, that Israeli spyware maker Candiru infected devices through ordinary online advertisements without any user interaction. According to The Hacker News, the Citizen Lab described the finding as the first public technical confirmation that mercenary spyware has reached real devices through targeted ads, a technique previously known only from leaked company documents.

What happened

The investigations center on Discover-Tech, an Israeli company registered in 2020 that presents itself as a digital advertising business. The Record reports that the researchers describe it as a bridge between ad vendors and spyware makers, and that Candiru allegedly hired Discover-Tech to deliver the ads. A separate threat actor tracked as Dark Cartographer also reportedly used Discover-Tech's software.

The confirmed victims include Al Jazeera. According to The Hacker News, at least 45 Al Jazeera devices were targeted in 2024 and 2025, and the Citizen Lab linked the attacks to Candiru with high confidence. The Record adds that other reported targets include reporters, dissidents, embassy staff and government officials. Neither publication names the government clients behind the operation.

Technical details

As described by The Hacker News, each ad carried a small script that, when loaded, sent the device's advertising ID and IP address to a Discover-Tech server, sometimes while the ad was rendered out of sight. The server then decided whether the device was a target, and only selected devices received attack code. Because the ad itself contained no exploit, ad networks had nothing malicious to detect. Al Jazeera's traffic logs showed a chain running from a Discover-Tech ad server to a Candiru screening server and then to a command-and-control server.

Researchers recovered the spyware from one device as well as a Windows executable whose techniques matched a Candiru tool the Citizen Lab analyzed in 2021. The initial browser or app exploit was not recovered, and no CVE identifiers have been disclosed. The Record reports that Discover-Tech's platform, called Controlium, allegedly lets clients fingerprint and automatically infect devices when an ad is displayed.

Who is affected

The scale of the ad infrastructure is large. On one platform, Discover-Tech placed nearly four billion ad bids between March and June 2026, and ads carrying its callback code appeared in about 75,000 mobile apps and 120,000 websites, The Hacker News reported. Confiant estimated the company's traffic at roughly 10 million ads a day. Ads were rendered on networks belonging to NATO, the United Nations, EU bodies and government offices in about two dozen countries, though the researchers stress that this does not mean users there were infected. Confiant found that the few ads directly tied to Candiru were low-volume and mostly reached home and mobile connections.

Google removed Discover-Tech "for systematically violating our policies," according to The Hacker News, while IAB Europe, Comcast-owned Beeswax and Eskimi also cut ties and Vungle paused its access pending review.

What to do

• Block the published indicators, including the Discover-Tech ad server domain mtrtb[.]com and the spyware sample hash 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8, plus the full list in Confiant's report.
• Search network logs for the sequence of contacts with a Discover-Tech ad server, a Candiru screening server and a command-and-control server.
• Organizations employing journalists, diplomats or officials should consider network-level ad blocking on managed devices and prioritize threat hunting for staff likely to be targeted.