Simply seeing an online ad was enough to infect devices at Al Jazeera with spyware, according to a Citizen Lab report published on Thursday.
The University of Toronto researchers say it is the first public technical proof of so-called zero-click spyware arriving through ads, in which victims did not have to tap or click anything.
The report ties at least 45 Al Jazeera devices, targeted in 2024 and 2025, to Candiru. Citizen Lab first exposed the Israeli spyware maker, now known as Integrity Labs, in 2021, the same year the US blacklisted it.
The ads themselves came from Discover-Tech, an Israeli company that presents itself as an advertising firm. In practice, Citizen Lab says, it acts as a go-between for several spyware vendors, Candiru among them.
The method relies on real-time bidding, the split-second auctions that decide which ad a person sees when a page or app loads.
Each time a Discover-Tech ad appeared, a script checked the device’s ad ID and IP address. A device on the target list received code that started the attack, while every other device got back nothing at all.
That meant nobody had to click, and also meant the ad companies serving the ads never saw the harmful code.
The operation was large, too, and after reviewing nearly four billion ad-bidding records, the researchers found Discover-Tech ads in more than 70,000 apps and 120,000 websites between March and June 2026.
Some of those ads landed on government and defence networks, including NATO’s. Confiant, an ad security firm that ran its own investigation, also spotted them at the US Department of Defense and the International Atomic Energy Agency. Yet, neither group found evidence that those bodies were actually infected.
Since 2020, Discover-Tech had sat on approved vendor lists at Google and IAB Europe, the ad industry’s trade body. Both have now cut it off, and Beeswax, Vungle, and Eskimi have also blocked or paused the firm.
Neither Discover-Tech nor Candiru responded to Citizen Lab’s requests for comment. The researchers say they cannot yet identify who was behind the attacks, and they have asked regulators to investigate whether the companies broke the law.
The case adds to a growing list of spyware cases, from Pegasus on an MEP’s phone to a fake WhatsApp app built by an Italian vendor.