Citizen Lab linked ad technology from Israeli firm Discover-Tech Ltd. to Candiru spyware attacks on Al Jazeera devices, showing how online ad auctions could help attackers reach selected targets without a click.
The research group said at least 45 Al Jazeera devices were targeted in 2024 and 2025. That figure does not represent 45 confirmed infections. In logs from infected devices, the researchers found contact with Discover-Tech infrastructure after an ad appeared, followed by a connection to a Candiru server used to check the device before further profiling and infection.
Citizen Lab found that code placed in Discover-Tech ads contacted the company’s server when an app or website displayed them. Citizen Lab said the server apparently used IP addresses and advertising identifiers to decide whether to return JavaScript that could run without a user clicking the ad. Most ad recipients were not selected for attack and received no executable JavaScript. Discover-Tech’s Controlium platform allowed customers to select targets by mobile advertising ID, browser identifier or IP address, the lab said.
The researchers examined nearly 4 billion ad bidding records from March through June 2026. They found Discover-Tech ads appearing across nearly 200,000 websites and Android and iOS apps. Those records describe the ad system’s reach, not the number of spyware infections. Citizen Lab said the ability to select individuals through ad auctions and weak vendor vetting helped make the attacks possible. It also said other ad recipients faced tracking, even when they were not selected for infection.
Citizen Lab compared an Al Jazeera spyware sample with a Candiru attack chain it captured in 2021. The lab identified Candiru as now known as Integrity Labs and called for regulators to examine whether it and Discover-Tech violated applicable laws.
Following the investigation, Google ended Discover-Tech’s access to its ad exchanges and IAB Europe removed the firm from its Global Vendor List on Oct. 8, according to Citizen Lab. Beeswax said it removed Discover-Tech from its buying platform. Vungle said it paused the firm’s access while reviewing the case; no decision date was given.
