A Citizen Lab investigation, prompted by Al Jazeera's initial internal checks, has confirmed that Israeli ad tech company Discover-Tech helped install spyware on dozens of devices used by Al Jazeera and other organizations.
On Thursday, Al Jazeera Media Network said it "condemns the targeting of the devices of several employees with spyware" and pledged to continue "protecting its staff and systems." The network called the targeting of journalists "an assault on press freedom and the public's right to know," and urged that those responsible be held to account.
Spyware from Candiru, a company blacklisted by the United States government in 2021 over malicious cyber activities, was installed on the devices. Citizen Lab described the case as the first known instance of "zero-click" targeted advertising.
According to Citizen Lab's report, Discover-Tech purchased advertisements with spyware embedded in them. The company then directed devices to Candiru's malware through those ads. The millions of targeted devices included those of Al Jazeera journalists, some of whom report on sensitive topics.
Al Jazeera's in-house technology team first detected anomalies on some journalists' devices in 2024. The problem continued into 2025. Al Jazeera contacted Citizen Lab to investigate more closely whether spyware was the cause.
The University of Toronto research group said in its report released Thursday: "Analysis of network logs provided by Al Jazeera to Citizen Lab during the attack period shows clear timing indicators of how the attack was carried out." Al Jazeera said the collaboration "helped verify the attacks and document them publicly."
The "zero-click" nature of the spyware installation means that once an infected ad appears on a device, that device is also infected — tracking and transmitting all data and information available on that platform to the attacker.
In a separate report, New York-based security firm Confiant said some Discover-Tech ads also appeared on major networks used by the Pentagon, the International Atomic Energy Agency and the International Criminal Court.
Candiru's spyware has previously been used to surveil at least 100 journalists, dissidents and others in multiple countries.
