Candiru Spyware's Zero-Click Ad Vector Infests Al Jazeera Windows PCs via Discover-Tech

The short version

• Zero-click spyware from Candiru was used to compromise devices at the news organization Al Jazeera.
• The infection vector was ordinary online advertising, which delivered malicious code without requiring any interaction from the user.
• This represents the first confirmed instance of mercenary spyware reaching targets via targeted ad networks, according to Citizen Lab.

The details

Security researchers at The Citizen Lab, a unit at the University of Toronto, published findings on Thursday detailing how government-backed spyware makers abuse global advertising networks. The report identifies an Israeli company, Discover-Tech, as the bridge between ad vendors and the mercenary spyware ecosystem. While Discover-Tech presents itself as a legitimate digital advertising firm, researchers found it allows clients to target specific individuals or devices almost anywhere in the world with surveillance tools capable of invisibly stealing data.

The researchers linked the attacks to two makers of zero-click spyware: Candiru and Bindecy. Both provide products that can infect devices without the victim opening a message or clicking a link. In the Al Jazeera case, at least 45 Windows computers were compromised in 2024 and 2025. The devices were hacked after being exposed to online ads packed with malicious code. The hidden attack code ran the moment an ad loaded on the screen, and in some instances, the ad loaded out of sight in the background.

Citizen Lab stated it was not clear which governments were behind these specific attacks, but noted this is the first technical confirmation of zero-click government-backed spyware being delivered through online ads. Bill Marczak, a senior researcher at Citizen Lab, said there had been buzz about ads being used for pinpoint hacking, but this report provides concrete technical evidence of the process in action. The findings suggest a vast number of devices worldwide could be at risk of similar targeted hacking.

The context

Hackers have long sought to abuse access to advertising networks because they can reach almost any internet-connected device globally. Ad networks are designed to help advertisers target specific demographics, devices, and organizations, but this capability can be turned against users to deliver malicious code. While malvertising attacks are not new, using them to silently install powerful government spyware is a notable escalation in threat sophistication.

The researchers recovered the spyware from one Al Jazeera device but did not capture the initial exploit that breaks into the browser. The attack setup involved ads placed by Discover-Tech. Each ad carried a small piece of code that sent the device's advertising ID and internet address to a Discover-Tech server. That server decided if the device was a target. If it was, the server sent back attack code for the browser to run. If not, it sent nothing, meaning the ad networks themselves had no harmful code to detect.

What to watch

• Monitor for new disclosures regarding other spyware vendors using advertising platforms as delivery mechanisms.
• Watch for updates from Discover-Tech or other ad-tech firms regarding their screening processes for malicious actors.
• Observe whether other news organizations or human rights groups report similar zero-click infections via ad networks.
• Track any regulatory responses to the use of ad-tech infrastructure for state-sponsored surveillance operations.

What it means for organisations

Operations teams must recognize that standard web browsing carries significant risk from sophisticated state actors. Security leaders should verify whether their ad-blocking policies cover background ad loaders and whether endpoint detection can identify zero-click installation attempts. Procurement teams need to assess the supply chain risks of third-party advertising technologies. Incident response plans should include scenarios where compromise occurs without user interaction, ensuring that forensic capabilities can trace infections back to ad network interactions rather than just email or phishing links.

Background: Malvertising

Malvertising is a cyberattack method that delivers malware through compromised digital advertisements. Attackers inject malicious code into ad networks that serve legitimate sites. Your browser loads the ad and executes the code automatically. You do not need to click anything for the infection to occur.

Read the full guide: What is Malvertising: How Ads Infect Your Browser Without Clicks

What to do and how to stay safe: Candiru

• Ensure all operating systems and browsers are updated to the latest versions to patch known vulnerabilities used in zero-click exploits.
• Deploy robust ad-blocking extensions or network-level filters to prevent background ad loading and reduce exposure to malvertising.
• Monitor network traffic for unusual connections to unknown servers, particularly those following ad-viewing activity on corporate devices.
• Educate staff that simply viewing web pages can be a vector for infection, reinforcing the need for strict device hygiene and least-privilege access.

Step-by-step guide: Secure Home Routers for Small Business Networks

General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is zero-click spyware?

Zero-click spyware is malicious software that can infect a device without the user needing to click a link, open an attachment, or perform any other action.

Which company provided the advertising platform for these attacks?

Discover-Tech, an Israeli company that presents itself as a legitimate digital advertising firm, provided the platform used to target the devices.

How many devices at Al Jazeera were affected?

Researchers found evidence that at least 45 Windows computers at Al Jazeera were hacked in 2024 and 2025 via this method.