Citizen Lab finds Israeli firm Candiru behind 'zero-click' ad spyware attacks

An investigation by the Canada-based academic research unit Citizen Lab has found that the Israeli spyware company Candiru used malicious online advertisements to infect devices in a "zero-click" attack, including 45 devices used by Al Jazeera staff in June 2025.

The technique requires no click, download or link: the advertisement itself delivers the infection. Al Jazeera's in-house technology team first noticed unusual patterns on journalists' devices in 2024, and network logs it provided to Citizen Lab in 2025 gave researchers a clear picture of how the attack was carried out.

How the attack worked

Citizen Lab found the advertisements were bought by Discover-Tech, an Israeli company presenting itself as a legitimate advertising firm but which researchers describe as a facilitator for mercenary spyware partners. Its advertisement network identified Al Jazeera staff and quietly redirected them to an infected server belonging to Candiru.

Candiru was blacklisted by the US government in 2021, when Citizen Lab found it responsible for illegal hacking and surveillance of at least 100 activists, journalists and political activists in 10 countries.

Stephen O'Shaughnessy, a lecturer in cybersecurity at TU Dublin Blanchardstown, explained that advertising space is sold by automated auction in a fraction of a second, sharing data about the user including device ID, IP address, rough location and the site or app they are on. "Discover-Tech posed as an ordinary advertiser, used that data to find their target and win the auction for that person's screen," he told Al Jazeera. "Because no message or link is involved, there is almost nothing for the victim to notice."

Once a device is infected, the software can collect files, documents and browser data such as cookies, bookmarks and saved credentials, capture keystrokes and screenshots, record microphone and webcam input and extract emails and messages. It often uses encrypted channels and splits stolen data into smaller chunks sent over time to avoid triggering security systems.

Analyst Eddy Willems noted a technical nuance: code running inside a browser does not automatically give an attacker full control, and escaping the browser's isolated "sandbox" may require a second vulnerability. "This is precisely what makes this type of attack so dangerous," he said.

Reach beyond media

Discover-Tech appeared on "certified" and "approved" vendor lists maintained by Google and the advertising industry association IAB Europe, and has served advertisements through major networks such as Google, Yandex and Beeswax.

Citizen Lab said the advertisements appeared on devices in national-security-sensitive networks used by defence ministries, armed forces, national cyber agencies, intergovernmental organisations and media outlets, including those of the United Nations, NATO, the European Parliament, the European Commission and the Council of the European Union's General Secretariat. Government networks in at least 24 countries were targeted, among them the United States, Italy, Denmark, Norway, Australia, Russia, Mexico and Israel.

The advertising security firm Confiant separately said some Discover-Tech advertisements appeared in critical networks used by the Pentagon, the UN's International Atomic Energy Agency and the International Criminal Court. O'Shaughnessy said infection was not confirmed there, only profiling of users, but called that concerning on its own.

Remesh Srinivasan, a professor of information studies at the University of California, Los Angeles, called the findings "incredibly concerning". "This is the next level, because people are being microtargeted," he said.

Al Jazeera Media Network condemned the targeting of its staff members' devices and called for those responsible to be held accountable.

O'Shaughnessy said the risk remains low for most people because such attacks are expensive and aimed at specific targets. He advised high-risk individuals to install an ad blocker, switch off their advertising ID in phone privacy settings, keep everything updated and turn on Lockdown Mode or Android's Advanced Protection. He added that the advertising industry needs to vet who buys ads, while regulators should stop personal data being shared with thousands of unknown bidders in every auction.

Source: Al Jazeera.