Check Al Jazeera Devices for Spyware After Zero-Click Ad Campaign

Al Jazeera staff and their devices are the confirmed victims in a sophisticated cyber-espionage campaign. Researchers at Citizen Lab documented how simply viewing an online advertisement allowed powerful spyware to infect these systems. No clicking, downloading, or user interaction was required for the infection to take hold. This represents a significant breach of privacy and security for the news organisation’s workforce.

Who is affected and what data is at risk

The primary targets identified in the Citizen Lab investigation are devices belonging to the international news network Al Jazeera. According to the report published on 15 October 2026, at least 45 devices were compromised during the period spanning 2024 and 2025. The spyware involved is linked to the Israeli vendor Candiru, which now operates under the name Integrity Labs. Network logs showed infected systems contacted Discover-Tech infrastructure after an ad was displayed.

How the infection occurred without user interaction

The attack method, named AdFection, exploited the complex infrastructure of modern online advertising. When an ad loaded on a victim’s device, code within it contacted a server operated by Discover-Tech. This Israeli company presents itself as an advertising business but acted as a link between the ad market and spyware groups. The server checked if the visitor matched a specific target profile before delivering the malicious payload.

The role of advertising technology in the attack

Discover-Tech used its Controlium platform to identify targets through mobile advertising IDs, browser cookies, and IP addresses. Real-time bidding systems share device data rapidly so advertisers can decide whether to buy an ad slot. AdFection used this design to find selected devices and send code only to them. This made the activity harder for ad platforms and security researchers to detect in real time.

Scale of the operation and detection challenges

The scope of the operation was significantly larger than the confirmed infections at Al Jazeera. Researchers examined approximately four billion Discover-Tech bidding records covering four months in 2026. The company’s ads appeared on nearly 200,000 unique websites and applications across dozens of countries. Millions of devices were directed toward Candiru-linked servers for tracking and checks. However, seeing a Discover-Tech ad does not prove that a device was infected.

What affected people can do

Staff at affected organisations should assume their devices may have been compromised if they were active during the campaign period. They should check for unusual network connections, particularly those linking to unknown servers shortly after viewing advertisements. Users should look for unexpected battery drain or performance issues, which can indicate background spyware activity. Teams usually recommend isolating suspect devices from the network to prevent further data exfiltration. It is also wise to monitor accounts for unauthorised access or password reset attempts, as attackers often seek credentials after gaining initial access.

Background: Spyware

Prioritise removing unnecessary app permissions and enabling multi-factor authentication to block data exfiltration. Keep software updated to patch known entry points. Avoid clicking suspicious links, as these often install infostealers that bypass traditional security measures.

Read the full guide: Stop Spyware: Practical Prevention Measures That Actually Work

What to do and how to stay safe: AdFection

• Review network logs for connections to unknown servers, especially those occurring immediately after loading web pages or applications.
• Update all operating systems and browsers to the latest versions to patch known vulnerabilities that could be exploited by similar techniques.
• Use strong, unique passwords for all critical accounts and enable multi-factor authentication to protect against credential theft.
• Monitor bank and email accounts for suspicious activity, such as unauthorised logins or unexpected password changes.

Step-by-step guide: Endpoint Detection and Response for Small Teams

General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Do I need to click an ad to get infected?

No, the AdFection method allows spyware to infect devices simply by viewing the advertisement, without any clicks or downloads.

Which spyware vendor was involved in this campaign?

The spyware is linked to the Israeli vendor Candiru, which now operates as Integrity Labs.

How many Al Jazeera devices were infected?

At least 45 devices were targeted and infected during 2024 and 2025, according to the Citizen Lab investigation.