Candiru spyware hit at least 45 Al Jazeera devices through malicious online ads

On 15 October 2026, the University of Toronto's Citizen Lab published a report, titled Exposing AdFection, concluding that at least 45 devices belonging to Al Jazeera staff had been infected with spyware linked to the Israeli vendor Candiru (also known as Integrity Labs). What sets the operation apart, researchers said, is the delivery method: the spyware reached its targets through zero-click online advertisements, requiring no action from the victims — a technique Citizen Lab described as the first confirmed attack of its kind.

The malicious ads were served through a platform called Controlium, run by an Israeli ad-tech firm named Discover-Tech, which Citizen Lab characterized as a facilitator for mercenary spyware operators. By buying ad inventory and profiling and fingerprinting specific people, the platform could infect a target's device when an ad was shown. Citizen Lab said Discover-Tech's ads ran in nearly 200,000 apps and websites and reached networks tied to media outlets, government ministries, security agencies, NATO, and the UN — though it stressed that ad impressions alone do not confirm spyware targeting.

Discovery and timeline

Al Jazeera's own technology team first noticed anomalies on journalists' devices in 2024, and Citizen Lab said the targeting continued through 2024 and 2025. The researchers recovered the spyware from one device but not the exploit used to break in, and they did not identify which government or client commissioned the operation. Candiru was blacklisted by the U.S. government in 2021.

Reaction

Al Jazeera condemned the campaign as an "assault on press freedom and the public's right to knowledge" and said its own information had helped verify and document the attacks. The Committee to Protect Journalists (CPJ) called on Israeli and other authorities to investigate and hold those responsible to account, and urged governments and companies to act so that advertising infrastructure can no longer be turned into a vehicle for targeted surveillance. Neither Discover-Tech nor Candiru responded to requests for comment before publication.