The Committee to Protect Journalists calls on Israeli and other relevant authorities to investigate and hold to account those responsible for reportedly infecting Al Jazeera news network devices with spyware delivered via online ads, and on governments and corporations to act urgently to ensure advertising no longer enables targeted surveillance.
“The mass surveillance architecture supporting online advertising is being harnessed for other purposes and puts journalists at risk,” said Jonathan Rozen, CPJ’s deputy director of research, who reported on such threats in August. “Citizen Lab’s findings that Al Jazeera devices were infected with spyware delivered via targeted ads make these surveillance dangers even clearer.”
Details of how an Israeli company called Discover-Tech facilitated the targeting in 2024 and 2025 of at least 45 Al Jazeera devices with spyware from a firm known as Candiru/Integrity Labs were released October 15 in an investigation by the University of Toronto-based Citizen Lab research group on advertising spyware, entitled “Exposing AdFection.”
The report did not name a government or specific client of the companies involved as responsible for ordering the attacks on Al Jazeera.
Presenting as a legitimate advertising company, and with connections to the Israeli cyber-espionage sector, Discover-Tech operates a platform called Controlium that “allows malicious actors to precisely profile and de-anonymize millions of individuals, fingerprint their devices, and target them with a form of zero-click hacking, where their devices can be automatically infected when an ad is displayed to them,” Citizen Lab’s report said.
In addition to Al Jazeera, Citizen Lab found that Discover-Tech-facilitated ads had been delivered to networks of other media organizations located in Austria, Denmark, France, Mexico, Israel, Italy, Norway, and Sweden, as well as to networks of international media services. The report did not name the other outlets, noting investigations into those cases are ongoing, and said Discover-Tech ads were also shown in networks of government ministries, security agencies, and international organizations, including NATO and the UN.
These ad impressions alone do not confirm spyware targeting, but they minimally suggest profiling of the devices by Discover-Tech and/or its surveillance partners, Citizen Lab said.
Citizen Lab’s review of server records showed “Discover-Tech ads were served in almost 200,000 different Android apps, iOS apps, and websites in many countries.” The report also listed news sites in various countries where ads were displayed.
In late August, CPJ and Harvard University’s Carr-Ryan Center for Human Rights jointly published reporting on how mass surveillance from online advertising threatens journalists and press freedom, including by enabling harvesting of personal data, location tracking, and ad-delivered spyware.
CPJ has published safety guidance for mitigating surveillance from ad tech. Citizen Lab’s report also includes protective actions, emphasizing ad-blocking as a cybersecurity best practice and noting “there is currently no consistently safe way” to be exposed to targeted ads.
CPJ contacted Discover-Tech and Candiru/Integrity Labs by email to comment on the report and on our call for responsible parties to be held to account, but has not yet received a response.
Citizen Lab said neither Discover-Tech nor Candiru/Integrity Labs replied to requests for comment before the publication deadline.
CPJ also contacted Al Jazeera by email but has not yet received a response.