-
Researchers link an Israeli advertising company to spyware attacks on at least 45 devices at Al Jazeera.
-
The ad network appeared on more than 120,000 websites and 75,000 mobile apps.
-
Ads also showed up on networks tied to NATO and the United Nations, but this does not prove any hack succeeded.
An Israeli advertising company is accused of helping spies hide spyware inside online ads. The company is called Discover-Tech. Victims did not need to click on anything to get infected. Experts call this kind of attack zero-click.
Citizen Lab, a research group at the University of Toronto, published its findings on October 15, 2026. The group linked the trick to attacks on devices used by Al Jazeera journalists. Researchers named the method AdFection.
Confiant, a cybersecurity company, released separate research alongside the Citizen Lab report. Together, the two studies raise worries about how normal ad systems can help secret spying. Spyware is a program that secretly watches a person’s device.
How the Ads Carried Hidden Spyware
According to Citizen Lab, Discover-Tech ran an ad platform called Controlium. The platform could spot internet users and build profiles about them. Profiling means collecting details about a person’s device and browsing habits. It then pushed chosen targets toward spyware. The company called itself a digital advertising business. Researchers described its setup as a bridge between ad networks and sellers of spyware.
Ad systems place ads on websites and mobile apps automatically. Discover-Tech used those same systems to run its attacks. When an ad loaded on a device, its hidden code contacted the company’s servers. That link lets the system pick targets out of the crowd of viewers. If the device matched a chosen target, the system sent code that started the spyware attack. The user never had to click the ad.
This method differs from phishing. Phishing often needs victims to open a bad link or file. With AdFection, simply loading a targeted ad could start the attack. Many attacks need the victim to make a mistake. This one needed no mistakes at all. A chosen target only had to load a page or app that showed the ad.
Fake online ads have also featured in separate malware campaigns targeting Apple users. Security researchers have warned about a campaign that uses deceptive advertisements to target macOS devices.
Citizen Lab tied the operation to Candiru, an Israeli spyware company. The US government added Candiru to its trade restriction list in 2021. Officials took that step over claims of harmful cyber activity. The researchers said their evidence is the first public technical proof of hired spyware sent through targeted ads. Hired spyware means spying software made by companies that sell it to paying clients.
Al Jazeera Devices Hit as the Ad Network Spread
Citizen Lab found at least 45 Windows devices at Al Jazeera that attackers broke into. The attacks were linked to Candiru spyware and took place between 2024 and 2025. Al Jazeera’s own tech team first noticed odd activity on journalists’ devices. That alert started the investigation. The broadcaster then shared its network logs with the researchers to support their work. Logs are records of what happens on a network.
Al Jazeera condemned the attacks on its staff. It said it will keep taking steps to protect its workers and systems. The case shows the risks journalists face when spies target their messages and sensitive reporting.
The wider ad network was huge. Citizen Lab found ads with suspicious scripts on 120,768 websites and 75,373 mobile apps. Confiant reported that Discover-Tech sent out at least 10 million ads every day. Only a small part of that activity linked to spyware delivery.
A script is a small piece of code that runs on a page. Citizen Lab said the suspicious ones sat inside ads on thousands of sites and apps. Each report adds its own numbers, and both show how far the network reached.
Researchers also found ads on networks tied to NATO, the United Nations, government agencies, and big tech companies. This does not mean every one of those groups was hacked. A network showing an ad is not the same as a spyware infection. According to Citizen Lab, more checks are needed to learn whether other users were hit.
Google and Ad Groups Cut Ties with Discover-Tech
The findings pushed several ad groups to act against Discover-Tech. Reports say Google removed the company from its ad platforms for repeatedly breaking its rules. IAB Europe also suspended Discover-Tech from its list of approved vendors.
Beeswax, the ad technology arm of Comcast, removed the company from its platform as well. Each group acted on its own platform. These moves cut the company’s access to ad systems and limit its reach. Reports also say Discover-Tech did not answer requests for comment. Efforts to reach the owners of Candiru failed too.
The case raises bigger questions about privacy in the ad industry. Ad systems often collect details about devices and browsing habits to show targeted promotions. Researchers warn that attackers can misuse that same setup to spy on people.
The full size of the operation is still unclear. Still, the findings show that ads can become a tool for targeted spying. People can be hit even when they never touch the ads they see.
