Check your device: Al Jazeera staff targeted by zero-click spyware via ads
Researchers found that Candiru used online advertising networks to deliver surveillance tools to journalists without requiring any clicks.
Key points
- Citizen Lab linked ad-delivered spyware to Candiru, also known as Integrity Labs.
- Al Jazeera devices were targeted in zero-click attacks during 2024 and 2025.
- The advertising platform MyDSP won hundreds of millions of ad impressions globally.
Journalists at Al Jazeera are the focus of a surveillance investigation that used online advertisements to target their devices. Researchers from Citizen Lab found that the Israeli vendor Candiru, now operating as Integrity Labs, exploited advertising infrastructure to target these users. This method required no interaction from the victims, meaning they were targeted simply by viewing content.
Who is affected by this surveillance campaign?
The primary group identified in the investigation is staff at the international news network Al Jazeera. Citizen Lab researchers analysed network logs provided by the broadcaster and linked specific attack activity to Candiru’s spyware. The report states that at least forty-five devices within the organisation were targeted in these attacks. These incidents took place during 2024 and 2025, representing a sustained operation rather than a one-off event.
How did the spyware reach the targets?
The malware was delivered through the Discover-Tech advertising platform, specifically its MyDSP service. Spyware vendors used this ad infrastructure to profile potential targets and deliver exploits without requiring users to click on anything. The system allowed the attackers to select particular devices for intrusive operations. Citizen Lab linked this delivery method with high confidence to the attacks on Al Jazeera, providing technical evidence of a real operation.
How widespread is the underlying advertising activity?
The advertising network involved in the spyware delivery processed a massive volume of data. Citizen Lab examined nearly four billion advertising bid records covering March to June 2026. During this period, the MyDSP platform bid on almost 3.77 billion ad impressions and won about 442 million. Reuters, citing Citizen Lab and advertising security firm Confiant, reported that this activity reached more than 120,000 websites and 75,000 mobile apps, potentially exposing hundreds of millions of people to the tracking infrastructure.
What other companies are linked to this network?
The investigation suggests that Discover-Tech’s infrastructure served multiple surveillance customers. Citizen Lab identified links involving other surveillance companies, including Bindecy and Intelos. This indicates that the advertising platform was not exclusively used by Candiru. The US government placed Candiru on its Entity List in 2021 due to its activities. The researchers noted that the database showed only three advertisers with nine total combinations of advertiser and domain names during the review period.
What affected people can do
Organisations should treat any unexpected network behaviour as a potential compromise. Teams usually isolate affected devices immediately to prevent data exfiltration. Check whether your security logs show connections to unknown advertising domains. Users should be aware that seeing an ad does not guarantee infection, but it indicates exposure to tracking infrastructure. Monitor for follow-up scams that often reference recent security breaches. Do not ignore unusual battery drain or performance issues, as these can signal background surveillance processes.
Background: Spyware
Prioritise removing unnecessary app permissions and enabling multi-factor authentication to block data exfiltration. Keep software updated to patch known entry points. Avoid clicking suspicious links, as these often install infostealers that bypass traditional security measures.
Read the full guide: Stop Spyware: Practical Prevention Measures That Actually Work
What to do and how to stay safe: Candiru
- Verify that your mobile operating system is updated to the latest version to patch known vulnerabilities.
- Review app permissions and remove applications that do not require access to sensitive data.
- Enable two-factor authentication on all critical accounts to protect against credential theft.
- Monitor bank and credit card statements for unauthorised transactions that might indicate identity misuse.
Step-by-step guide: Endpoint Detection and Response for Small Teams
General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does seeing an ad from this network mean my phone is infected?
No, Citizen Lab states that most advertisements did not necessarily deliver spyware and seeing one does not prove a device was compromised.
Which spyware vendor is responsible for the Al Jazeera attacks?
The attacks are linked to Candiru, an Israeli spyware vendor that the US government placed on its Entity List in 2021.
How many devices at Al Jazeera were targeted?
At least forty-five devices within Al Jazeera were targeted in the zero-click attacks linked to Candiru’s spyware.
