Citizen Lab: online ads delivered spyware to Al Jazeera
A report on Discover-Tech places Candiru's spyware on at least 45 devices at the outlet; Google has already blocked the ad company.
The Citizen Lab, a research group at the University of Toronto, has documented how online ads were used to infect devices with spyware without the victim clicking anything. It lays this out in report 195, published Oct. 15, 2026 under the title "Exposing AdFection". Its authors describe it as the first time anyone has confirmed the method with public technical evidence.
Al Jazeera is the documented case: at least 45 of its devices were attacked in 2024 and 2025 with spyware from Candiru, an Israeli company renamed Integrity Labs. TechCrunch specifies that they were Windows computers. The lab had already documented Candiru in 2021.
The new part is the delivery. The ads were bought by Discover-Tech, another Israeli firm, through real-time bidding, the mechanism ad platforms use to decide in milliseconds which ad each user sees. With Controlium, its platform, a customer can aim an ad at one specific person using the advertising ID of their phone, the ID of their browser or their IP address. According to the report, Discover-Tech has ties to Bindecy and Intelos, two more companies in that business.
In an analysis of about four billion bidding records from March to June 2026, the lab found Discover-Tech ads carrying the attacker's scripts in 75 373 apps and 120 768 websites. The ads appeared on networks of governments, armed forces, universities, media outlets and critical infrastructure. A viewed ad, the report notes, does not prove an infection, and the text documents no infections beyond those 45 devices. It also assigns no CVE, the public identifier for a vulnerability, and does not say whether a patch exists.
In early October, Google and IAB Europe removed Discover-Tech from their lists of certified vendors, and Google also denied it access to its ad exchanges. According to Engadget, Google blocked it for systematically violating its policies. The platform Beeswax and Eskimi also acted, and Vungle, part of Liftoff, paused its access while it reviews the case, the report says.
Bill Marczak, a researcher at the Citizen Lab, told TechCrunch that anyone who could be a target of this kind of attack should act on ad tracking:
It's time to disable ad tracking on your devices.
For users in general, the report recommends a trusted ad blocker, a privacy-respecting browser and regularly resetting the mobile advertising ID. Marczak called Discover-Tech "surely just the tip of the iceberg".
The sources consulted do not record a response from Discover-Tech, Candiru, Bindecy, Intelos or Al Jazeera. The lab is preparing a separate report on another actor, DARK CARTOGRAPHER, which according to the text uses Discover-Tech's infrastructure to link advertising IDs to phone numbers.
