- Researchers uncovered a zero-click spyware campaign delivered through online advertisements, requiring no user interaction
- Journalists’ devices were infected with surveillance malware capable of stealing data, messages, audio, and video
- Investigation linked the operation to Israeli firms tied to ad-tech infrastructure and commercial spyware
Imagine this: You’re a journalist. You get to work, log into your computer, and go about your daily activities. While browsing the internet, you see an ad for earbuds. You don’t click the ad, you don’t even view it with interest. You just get it served, much like any other ad on the internet, and scroll away to continue with your day.
But the moment the ad was served, through it your computer was infected with a powerful infostealer. The malware harvested all sorts of sensitive data, including files, documents, cookies, bookmarks, even saved credentials. It captured your keystrokes, took screenshots while you were working, and was even able to use your microphone and camera to record you while you were working.
Email messages, as well as instant messages shared through a wide range of platforms, were picked up and exfiltrated, as well.
Mission impossible
While this might sound like a scene from a Mission Impossible movie, unfortunately it’s completely real. The victims in this story are Al Jazeera journalists (among others). In 2024, some of the journalists noticed their devices acting strange, so they reached out to Canadian cybersecurity firm Citizen Lab, who confirmed the first-ever case of zero-click mercenary spyware attack that was delivered through online ads. They’re calling it “AdFection”.
Both Al Jazeera and Citizen Lab have released their findings, and while the question of who might be attacking journalists remains unanswered, the researchers know who facilitated it - two Israeli companies, one of which has been on the US blacklist for half a decade now.
The two companies are called Candiru and Discover-Tech. The former is a mercenary spyware company that sells sophisticated surveillance tools to government customers. They were the ones who built the infostealer and the delivery mechanism. The researchers did not say who bought the tool and who was spying on the journalists, but they did say that the infostealer cost “several million dollars”.
Candiru is now known as Integrity Labs, following a rebranding and reported acquisition. The US Department of Commerce blacklisted it in early November 2021, citing evidence that it supplied spyware to foreign governments that used it to target government officials, journalists, activists, and others. However, it seems Candiru was delisted in late July, 2026.
The second company in the infection chain is Discover-Tech. It is an Israeli ad-tech company operating MyDSP, a demand-side platform that purchases digital advertising inventory through automated ad exchanges. So allegedly, the ads carrying Candiru’s malware were served through Discover-Tech’s infrastructure.
The discovery raised questions if Discover-Tech was ever a legitimate business, or just a cover for a highly sophisticated cyber-espionage campaign.
Who are the targets?
“We present technical evidence that the Israel-based company Discover-Tech, while purporting to be a legitimate advertising company, appears to be a front for large-scale ad espionage abuse," Citizen Lab’s researchers wrote. “In fact, it appears that serving as this bridge is Discover-Tech’s primary purpose.”
The company was listed with both Google and IAB Europe as an approved vendor from 2020, The Register reported. Citizen Lab analyzed roughly four billion ad-bidding records and found Discover-Tech ads on more than 70,000 mobile apps and 120,000 websites in Q2 2026, alone.
So the question now is - how many people are affected, and where do they work?
Citizen Lab says that at least 45 devices belonging to Al Jazeera were compromised this way in 2024 and 2025. Citing data from New York-based advertising security firm Confiant, The Register reported that some of Discover-Tech’s ads also appeared in critical networks used by the Pentagon, the United Nations International Atomic Energy Agency, and the International Criminal Court - the same court that in 2024 issued an arrest warrant against Israeli Prime Minister Benjamin Netanyahu, alleging responsibility for war crimes and crimes against humanity.
Via The Register