Symbolic imageIsraeli ad firm used online ads to help install spyware, researchers say
Citizen Lab and Confiant reported on Thursday that Israeli ad agency Discover-Tech used online ads to track users and help plant Candiru spyware. Devices at Al Jazeera were among those infected.
In separate reports published on Thursday, 15 October, the two research groups said Discover-Tech's ads, often for ordinary products such as phones or earbuds, reached more than 120,000 websites and 75,000 apps, according to Citizen Lab. The ads only had to load for users to be identified and tracked. Citizen Lab describes the zero-click delivery as a new technique. Confiant co-founder Jerome Dangu said the firm served at least 10 million ads a day and that "very likely hundreds of millions of people" were touched, though Confiant said ads tied to Candiru were a tiny fraction of the volume. Discover-Tech did not respond to requests for comment.
Al Jazeera devices infected
Citizen Lab says Candiru spyware delivered through the ads compromised 45 Windows devices at Al Jazeera between 2024 and 2025, which it confirmed with network logs the broadcaster shared. Al Jazeera condemned the attacks on its staff as an assault on press freedom and demanded that those responsible be held accountable.
Sensitive networks and Palestine
Confiant says the ads appeared in networks of the Pentagon, the International Atomic Energy Agency and the International Criminal Court. Dangu said Gaza and the West Bank were particularly saturated with the firm's ads. The US Commerce Department blacklisted Candiru in 2021.