Israeli Advertising Technology Company Helped Install Spyware on Al Jazeera Devices

Citizen Lab research finds that dozens of Al Jazeera devices were infected with malware planted through malicious advertising.

A Citizen Lab investigation conducted by Al Jazeera's internal primary investigation has confirmed that Israeli ad technology company Discover-Tech helped plant spyware on dozens of devices used by Al Jazeera and other companies.

Al Jazeera media network said Thursday that it "condemns the targeting of devices belonging to several of its employees with spyware" and pledged to continue "protecting its employees and systems."

The network said that targeting journalists is a "violation of press freedom and people's right to knowledge" and demanded accountability from its officials.

Spyware from Candiru, a company blacklisted by the US government in 2021 for its malicious cyber activities, was planted on the devices using what Citizen Lab described as the first known example of "zero-click" targeted advertising.

Citizen Labs, an interdisciplinary research unit at the University of Toronto, concluded in its report that Discover-Tech purchased the ads with embedded spyware. It then redirected the devices to the Candiru malware through these ads.

The millions of targeted devices include those belonging to Al Jazeera journalists - including a number reporting on sensitive issues.

Al Jazeera's internal technology team first discovered unusual patterns in the devices used by some journalists in 2024. This pattern continued until 2025. Al Jazeera contacted Sarvand Lab for a more detailed investigation on its suspicion of the existence of spyware.

"Analysis of network logs provided by Al-Jazeera during the period of the attack on Citizen Labs provides a clear time signature of how the attack was executed," the University of Toronto-based team said in its report, released Thursday.

Al Jazeera said the cooperation "helped verify these attacks and document them publicly".

The "zero hour" nature of this spyware installation means that as soon as an infected ad appears on a device, that device is infected too - spying on, and feeding, all the data and information on that platform to those who steal it.

Meanwhile, New York-based security firm Confiant said in a separate report that some Discover-Tech ads also appear on critical networks used by the Pentagon, the International Atomic Energy Agency and the International Criminal Court.

Candiru spyware has already been used to monitor at least 100 journalists, dissidents and others in several countries.