Researchers say that in 2024 and 2025, at least 45 devices within Al Jazeera were targets of 'zero-click attacks' that they link with 'high confidence' to spyware from Candiru, an Israeli company.FADI AROURI/Reuters
An Israeli spyware company hacked into the devices of Al Jazeera journalists through infected online ads that did not need to be clicked on to be deployed, an investigation by the University of Toronto’s Citizen Lab has revealed.
The Citizen Lab, which researches how technology is used to threaten human rights and security, says in a 72-page report published Thursday that this is the “first public technical confirmation of a zero-click mercenary spyware attack delivered via targeted advertising.”
The researchers say the devices were infected with mercenary spyware from Candiru, an Israeli company that the report indicated was rebranded as Integrity Labs after being acquired by a U.S. company. The spyware was deployed through targeted online advertisements.
The infected ads were purchased by Discover-Tech, another Israeli company that the researchers said presents as a legitimate advertising business but is actually a bridge between multiple spyware companies and the online advertisement industry.
The report says Discover-Tech has a platform called Controlium that allows malicious actors to profile and de-anonymize “millions of individuals, fingerprint their devices, and target them with a form of zero-click hacking, where their devices can be automatically infected when an ad is displayed to them.”
The company’s ads were shown on almost 200,000 unique websites and Android/iOS apps in dozens of countries over a four-month period, according to the researchers, who analyzed four billion records detailing Discover-Tech’s bidding on ads.
“It’s kind of a nightmare because it shows that devices can potentially be infected by spyware mercenaries, spyware companies, by just viewing an ad on a website or in a mobile app silently,” said Wolfie Christl, a co-author of the report who is based in Vienna.
Mr. Christl said his team also found that Discover-Tech is connected to other mercenary spyware firms such as Intelos and Bindecy.
Mr. Christl says the international community must investigate the companies revealed in the report and think about how to fix the system. 'They must urgently step in here.'Graeme Roy/The Canadian Press
The largest players in the online advertising industry, including Google and the advertising industry association IAB Europe, have revoked Discover-Tech’s access to their systems as a result of the investigation, Mr. Christl said.
“It’s still disastrous that major ad vendors and organizations apparently were neither able to detect nor prevent this company’s malicious advertising operations for several years,” he said.
The report explains how Candiru and Discover-Tech ads infect devices. Discover-Tech wins a bid on an ad, and then displays its own ad on a website or app. The person using the computer or smartphone may see the ad – or it may simply exist in the background.
The report includes an ad for free games on a CBC News website as an example. The report says that most users who see the ad are not targeted, but it will gather data from their browser or app and send it back to Discover-Tech, including information such as the IP address.
The researchers say that in 2024 and 2025, at least 45 devices within Al Jazeera were targets of “zero-click attacks” that they link with “high confidence” to Candiru spyware delivered through Discover-Tech ads.
Opinion: France’s melted freezers hack can happen in Canada, too
While the Al Jazeera journalists were directly targeted, the researchers uncovered that Discover-Tech ads were “shown on devices in national-security-sensitive networks around the world,” including those of defence ministries, militaries, national cybersecurity agencies, media organizations and intergovernmental and security organizations such as NATO.
In Norway, the ads were shown to users on the networks of the legislature, the country’s digital agency and communications authority, state IT network and key military installations, as well as police units. In Sweden, to users on a range of key networks, including those used by the armed forces, the state power company and a defence contractor. And in Denmark, to users on a variety of networks such as those of the national rail service, municipal and regional governments, banks and Copenhagen Airport.
The report also lists networks where Discover-Tech ads were shown, such as those of Armenia’s Prime Minister’s Office, several government ministers in Czechia and Israel and Italy’s Ministry of Defence, as well as many others.
It’s not clear if these states, ministries or organizations were hacked, but they were profiled, which is a preliminary step to hacking.
Mr. Christl said the ads are not just images or videos − they carry code, and the code is executed in the background, which is how the infection happens. And the advertisers that display the ads, he said, can run a code on websites and apps that is actually running on an individual’s device.
“Cybersecurity agencies and all other kinds of regulators and lawmakers in the U.S. and Canada and Europe and other regions, they must urgently step in here,” Mr. Christl said, adding that the international community must investigate the companies revealed in the investigation and think about how to fix the system.
“Digital advertising is broken. And the way it currently works is a security threat for states, for the private sector, for civil society − and for everyone else.”