Full Report
Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that needed no click or other action from the user, researchers at the Citizen Lab said Thursday. The hidden attack code ran the moment an ad loaded on the screen, and in some cases the ad loaded out of sight, in the background. The Citizen
Analysis Summary
# Incident Report: Zero-Click Spyware Infection via Targeted Ad Injection
## Executive Summary
Candiru, an Israeli mercenary spyware firm, successfully compromised at least 45 devices at the news network Al Jazeera using "zero-click" exploits delivered through legitimate online advertising networks. The attack utilized a front company, Discover-Tech, to inject malicious code into ads that triggered automatically upon loading, even if the ad was rendered out of sight. The incident highlights a sophisticated shift in spyware delivery, moving from link-based phishing to the exploitation of the global digital advertising ecosystem.
## Incident Details
- **Discovery Date:** October 2026 (Public reporting by Citizen Lab)
- **Incident Date:** Ongoing throughout 2024 and 2025
- **Affected Organization:** Al Jazeera
- **Sector:** Media / Journalism
- **Geography:** Global (Middle East/International)
## Timeline of Events
### Initial Access
- **Date/Time:** 2024 - 2025
- **Vector:** Malvertising / Zero-click Ad Injection
- **Details:** Attackers utilized Discover-Tech (an approved ad vendor) to place ads containing tracking code. When an ad loaded on a target device, it sent the device's IP and Advertising ID to a Discover-Tech server for target verification.
### Lateral Movement
- **Details:** Not explicitly detailed in the report; the primary focus was the direct compromise of end-user devices (mobile and Windows) to establish surveillance.
### Data Exfiltration/Impact
- **Details:** Deployment of Candiru spyware, allowing for full device surveillance, including access to messages, calls, and files. At least 45 devices were confirmed as targeted.
### Detection & Response
- **Discovery:** Citizen Lab researchers analyzed Al Jazeera’s network traffic logs and a Windows program file recovered from a compromised device.
- **Response:** Research was shared with major tech platforms; Google and IAB Europe subsequently blacklisted the involved ad-tech entities.
## Attack Methodology
- **Initial Access:** Zero-click exploitation via malicious code embedded in digital advertisements.
- **Persistence:** Spyware installation on Windows and mobile platforms.
- **Privilege Escalation:** Exploitation of browser or application vulnerabilities to gain system-level access.
- **Defense Evasion:** Use of a "benign" front company (Discover-Tech) to bypass ad network security audits; attack code only delivered after target verification.
- **Credential Access:** Spyware capabilities typically include scraping stored credentials and session tokens.
- **Discovery:** Remote fingerprinting via IP and Advertising ID to confirm target identity before sending the exploit.
- **Lateral Movement:** N/A (Endpoint-focused surveillance).
- **Collection:** Interception of communications and file system access.
- **Exfiltration:** Data sent back to Candiru-controlled command-and-control (C2) servers.
- **Impact:** Total compromise of journalist privacy and source protection.
## Impact Assessment
- **Financial:** Undisclosed; high cost of forensic investigation and remediation.
- **Data Breach:** High-risk compromise of sensitive journalistic communications and source identities.
- **Operational:** Disruption to secure communications; necessity to rotate hardware for 45+ employees.
- **Reputational:** Significant; highlights the vulnerability of media organizations to state-sponsored mercenary tools.
## Indicators of Compromise
- **Network Indicators:**
- Traffic to Discover-Tech ad servers (e.g., `discover-tech[.]io` - *representative*)
- Subsequent connections to Candiru screening servers.
- Final C2 communication with known Candiru infrastructure.
- **File Indicators:**
- Distinctive Windows program files utilizing Candiru-specific obfuscation and code structures.
- **Behavioral Indicators:**
- Silent background loading of ad-related processes followed by unexpected outbound encrypted traffic.
## Response Actions
- **Containment:** Google, Beeswax, Eskimi, and Vungle revoked Discover-Tech’s access to ad exchanges.
- **Eradication:** Removal of spyware from affected Windows and mobile devices.
- **Recovery:** Restoration of secure communications and increased network monitoring at Al Jazeera.
## Lessons Learned
- **Ad-Tech Vulnerability:** The digital advertising supply chain is a viable and dangerous vector for zero-click exploits.
- **Targeting Sophistication:** Attackers are using "pre-flight" checks (Advertising IDs) to ensure they only burn expensive exploits on confirmed targets.
- **Vendor Trust:** Being an "approved vendor" by Google or IAB does not guarantee the legitimacy of a company's activities.
## Recommendations
- **Network Level:** Implement robust ad-blocking at the organizational gateway level to reduce the attack surface.
- **Endpoint:** Disable or reset Advertising IDs on professional devices regularly.
- **Policy:** Utilize "Lockdown Mode" (on iOS) or equivalent heightened security configurations for high-risk personnel (journalists, activists).
- **Supply Chain:** Ad networks must implement stricter behavioral analysis for ad-code that performs device fingerprinting.