Zero-Click Spyware Hid in Online Ads to Hack Al Jazeera, Citizen Lab Says

Government spyware has found a new way onto computers and phones, and it does not need anyone to click anything. Researchers at the University of Toronto's Citizen Lab say zero-click spyware made by Candiru was delivered through ordinary online ads, routed by an Israeli advertising company called Discover-Tech. According to the report, released on October 15, at least 45 Windows computers at the news network Al Jazeera were hit in 2024 and 2025 after they loaded ads carrying hidden code. It is the first time researchers have publicly shown, with technical evidence, that mercenary spyware reached real devices through the ad system most of us see every day.

The finding matters well beyond one newsroom. The same ad company's code showed up across tens of thousands of apps and websites, including on networks used by governments, militaries and international bodies. Here is what happened, how the attack worked, and what you can do about it.

What Citizen Lab found

Citizen Lab worked with Confiant, a US company that monitors the quality and safety of online ads. Together they traced infections at Al Jazeera back to ads served through Discover-Tech, a firm registered in 2020 that presented itself as a normal ad technology vendor.

According to TechCrunch, Citizen Lab says Discover-Tech actually acted as a middleman between ad networks and spyware makers. Its platform, called Controlium, let a customer pick out a specific person or device and push malicious content to it alongside regular ads. Two spyware makers were linked to the platform: Candiru and another company called Bindecy.

The Hacker News reports that the researchers tied the Al Jazeera operation to Candiru with high confidence. They did not name the government that paid for it. Candiru is no stranger to controversy. The US government added it to a trade blacklist in 2021, and in 2025 its assets were bought and moved into a new company reported as Integrity Labs, which the sanctions do not cover.

Bill Marczak, a senior researcher at Citizen Lab, told TechCrunch the case gives "concrete technical evidence showing this process in action." He also warned that Discover-Tech is "surely just the tip of the iceberg."

How zero-click spyware rode inside online ads

The clever and worrying part is that the ads themselves looked clean. Based on the account published by The Hacker News, the chain worked roughly like this:

1. Each ad carried a tiny script. When the ad loaded, the script sent the device's advertising ID and IP address back to a Discover-Tech server.
2. That server checked whether the device belonged to someone on a target list.
3. If it did, attack code was sent back to the browser or app. If it did not, nothing came back at all.
4. Network logs then showed the device talking to a Candiru screening server and finally to a command server that runs the spyware.

Because the ad never contained the attack code, ad networks scanning creatives had nothing harmful to find. Some of the ads even loaded out of view in the background, so the target would not have seen anything unusual.

What the researchers recovered

Investigators pulled a sample of the spyware from one infected machine, a Windows program whose code matched techniques Citizen Lab documented in a Candiru tool back in 2021. They did not recover the first stage, the exploit that actually breaks into the browser or app. The reports do not name specific vulnerabilities or say which browsers were abused, so it is not yet clear whether a patch would have stopped the break in.

Researchers also found sloppy security on Discover-Tech's own side. TechCrunch reports that parts of the Controlium source code were exposed on login pages, which let researchers rebuild the control panel without signing in. A public section of the site also leaked login records, some belonging to Candiru and Bindecy staff.

Why this matters

"Malvertising," the practice of hiding malware in ads, has been around for years. Most of it is crude and aims at as many people as possible. This is different. The targeting tools that let a shoe brand show you sneakers in a certain city were turned into a delivery system for spyware sold to governments.

The scale of the ad operation is striking, even if most of it did not lead to infections. According to The Hacker News:

• On one platform, Discover-Tech placed close to four billion ad bids between March and June 2026.
• Ads carrying its callback code appeared in about 75,000 apps and 120,000 websites.
• Confiant estimated roughly 10 million ads a day flowed through the company.

Those ads reached networks tied to NATO, the United Nations, EU bodies and government offices in about two dozen countries, as well as chipmakers and news outlets. TechCrunch adds that Confiant spotted potentially malicious ads on networks used by the International Atomic Energy Agency and the International Criminal Court. Both outlets stress that an ad appearing on a network does not mean anyone there was infected.

There is a policy angle too. Discover-Tech had been listed as an approved vendor by Google and IAB Europe from 2020 until this month. That raises hard questions about how ad industry vetting works when a vendor can sit inside the system for years.

Who is affected

For most US readers, the direct risk is low. Confiant found that the handful of ads it could tie straight to Candiru were low in volume and mostly reached home and mobile connections, which fits targeted espionage rather than mass hacking.

The people at real risk are the ones spyware buyers usually chase: journalists, activists, lawyers, diplomats, government staff and people who work in sensitive industries. Al Jazeera has been here before. In 2020, dozens of its journalists' iPhones were hacked with NSO Group's Pegasus spyware in a separate operation.

Organizations matter as much as individuals. Any company or agency whose employees browse on work devices could have seen these ads. That is why the report published technical clues for security teams, not just advice for the public. We saw a similar pattern with the Pentagon DMDC data breach, where the scale of exposure was the story even before the damage was known.

How the ad industry responded

Several ad platforms moved quickly once they were briefed in early October, according to The Hacker News:

• Google removed Discover-Tech from its vendor list and cut its access to ad exchanges, saying the company was "systematically violating our policies."
• IAB Europe suspended the firm after an audit found policy violations.
• Beeswax, owned by Comcast, removed it.
• Vungle paused its access pending review.
• Eskimi blocked its accounts.

Discover-Tech, Candiru's owners and Al Jazeera did not respond to requests for comment, according to both outlets.

What to do now

You do not need to panic, but a few simple steps cut your exposure to this kind of attack.

For individuals

• Turn off ad tracking. Marczak advised people who could be targeted because of who they are or what they do to disable ad tracking on their devices. On an iPhone, deny apps permission to track you. On Android, delete or reset your advertising ID in privacy settings.
• Block ads. Security experts have recommended ad blockers for years, and this case shows why. A browser with built in tracker blocking or a reputable ad blocking extension removes the delivery route entirely.
• Keep everything updated. The exploit stage was not recovered, but browser and operating system updates close the kinds of holes spyware needs. Our guide to protecting your online accounts in 10 minutes covers the basics.

For security teams

• Both Citizen Lab and Confiant published indicators of compromise. Block the listed domains, including the Discover-Tech ad server mtrtb[.]com, and the file hashes.
• Search network logs for the telltale sequence: a Discover-Tech ad server, then a Candiru screening server, then a command server.
• Treat ad traffic on sensitive machines as a real attack surface. Blocking ads at the network level on work devices is worth considering, especially for staff in high risk roles. Teams already patching urgent bugs like the recent Citrix NetScaler zero days know how quickly a quiet hole becomes a breach.

What to watch next

Expect more digging. Marczak's comment suggests researchers believe other ad firms play a similar role. Last December, leaked documents tied the spyware maker Intellexa to an ad based tool called Aladdin, but nobody had shown a live infection until now.

Lawmakers and regulators may also look harder at ad tech vetting and at sanctioned spyware vendors that reappear under new owners. And vendors such as Google will face questions about how a company stayed on approved lists for six years. For more on how attackers hunt for hidden flaws, see how researchers broke into phones at Pwn2Own Ireland 2026, and follow our tech coverage for updates.

Frequently asked questions

What is zero-click spyware?

It is surveillance software that infects a device without the owner tapping a link or opening a file. In this case, simply loading a web page or app that showed a targeted ad was enough.

Was I infected by these ads?

Very unlikely. Researchers say the attack code was only sent to specific targets, and the ads tied directly to Candiru were low in volume. Seeing a Discover-Tech ad does not mean a device was compromised.

Which company delivered the ads?

Citizen Lab named Discover-Tech, an Israeli ad technology firm. Google, IAB Europe and several ad platforms have since cut it off.

How can I protect myself from ad based spyware?

Disable ad tracking, use an ad blocker or a browser that blocks trackers, and install updates quickly. People in high risk jobs should take all three steps.