Israeli Firm Planted Spyware on Al Jazeera Devices (2024-2026)

Security researchers at the University of Toronto’s Citizen Lab revealed that an Israeli advertising agency used global ad networks to silently plant mercenary spyware on dozens of Al Jazeera devices during 2024 and 2025 without requiring any user interaction.

Al Jazeera journalists working on computers

The digital watchdog group published a 72-page investigation detailing how the Tel Aviv-based digital advertising agency Discover-Tech manipulated online advertisements to compromise 45 Windows computers at the Qatari broadcaster Al Jazeera. Working alongside ad-tech firm Candiru—which software security experts noted was rebranded as Integrity Labs—the operation marked the first time researchers documented zero-click government spyware delivered through targeted advertising, a technique Citizen Lab named AdFection according to the The Citizen Lab report.

Discover-Tech Weaponises Ad Networks Into a Spyware Pipeline

Unlike traditional phishing attacks that demand a click or a download, the newly exposed delivery system operates entirely in the background. Discover-Tech operated a proprietary platform named Controlium that acted as a bridge between automated real-time bidding auction systems and the mercenary spyware ecosystem.

#Karkadann (#Candiru) domains, mostly typosquatting Azeri websites. #ThreatHunting ⤵️checkhotel[.]netvergisorgula[.]comkoronamiyim[.]comopinionlimit[.]orgseffafxeber[.]comparkdev[.]netcaptivelogin[.]netolkem[.]net pic.twitter.com/u6LRsNJB87

— https://x.com/sekoia_io/status/1601166853673431040

The platform’s source code mentioned an endpoint called /csv-download which accepted start and end date parameters, while a publicly accessible portion of the company’s site allowed researchers to download user login records for the Controlium dashboard without a password. By abusing the digital advertising ecosystem, the platform could de-anonymize, fingerprint, and automatically infect target devices the moment an advertisement loaded on a website or inside a mobile app. The malicious software was designed to harvest sensitive browser data, cookies, bookmarks, and credentials while also capturing keystrokes, screenshots, and microphone inputs.

Discover-Tech has leveraged the advertising ecosystem for years to turn trusted websites and popular apps into a zero-click spyware delivery platform.

Bill Marczak, Senior Researcher at Citizen Lab

Global Reach and Exposure Across Sensitive International Networks

An analysis of advertising records showed that Discover-Tech bid to buy advertising space 3.7 billion times between March and June 2026, winning 442 million times and displaying ads across more than 120,000 websites and 70,000 mobile apps. The scale of the operation extended far beyond a single newsroom.

Al Jazeera journalists hacked using Israeli firm’s spyware

While millions of everyday users encountered the ads on popular platforms like the BBC, New York Times, Yahoo Mail, Duolingo, and dating apps such as Grindr, investigators from Confiant and Citizen Lab discovered that malicious ad impressions also appeared on critical infrastructure and national-security networks worldwide. According to Jerome Dangu of Confiant, the harmful advertisements reached users across hundreds of sensitive environments, spanning the International Criminal Court, the Pentagon, and the International Atomic Energy Agency. Danish users encountered the promotional content on various local networks, including Copenhagen Airport, regional and municipal administrations, banks, and the national railway system. Branches of the military have since disabled ad tracking on some devices.

Institutional networks of NATO and the United Nations.

The International Atomic Energy Agency and the International Criminal Court.

The European Commission, European Parliament, and the Council of the EU.
Defense ministries, militaries, and cybersecurity agencies in countries including Norway and Sweden.

Industry Backlash Forces Urgent Calls for Regulation

Major technology platforms moved swiftly once the findings came to light. Google joined other ad-tech companies, including Beeswax, in blocking Discover-Tech from its ad platforms for systematically violating policies, while IAB Europe and the largest players in the online advertising industry revoked the firm’s access to their systems.

Israeli Firm Planted Spyware on Al Jazeera Devices (2024-2026) — Photo: The Globe and Mail

It’s kind of a nightmare because it shows that devices can potentially be infected by spyware mercenaries, spyware companies, by just viewing an ad on a website or in a mobile app silently.

Wolfie Christl, Co-author of the report

Researchers emphasized that because standard home Wi-Fi and mobile data networks rarely maintain the deep network logging that Al Jazeera utilized, uncovering the ad-based attacks was exceptionally difficult.

Security experts urged individuals at high risk to disable ad tracking, regularly reset mobile ad IDs, or block ads altogether while international regulators investigate the firms involved.