An Israeli advertising technology company, Discover-Tech, has been implicated in placing spyware on devices belonging to Al Jazeera journalists and other organizations. This finding comes from an investigation by Citizen Lab, prompted by an initial internal probe from Al Jazeera.
Al Jazeera Media Network stated on Thursday that it "condemns the targeting of devices belonging to several of its employees with spyware." The network confirmed its voluntary collaboration with researchers, which helped verify and publicly document these attacks. Al Jazeera vowed to continue protecting its employees and systems, calling the targeting of journalists an "assault on press freedom and the public’s right to knowledge" and demanding accountability for those responsible.
The spyware used was from Candiru, a firm previously blacklisted by the U.S. government for malicious cyber activities. Citizen Lab identified this as the first known instance of "zero-click" targeted advertising being used to deploy such spyware.
According to Citizen Lab's report, Discover-Tech purchased advertisements that contained the spyware. These ads then directed devices to Candiru's malware. Several Al Jazeera journalists, including those reporting on sensitive topics, were among the millions of devices targeted.
Al Jazeera's internal technology team first noticed unusual patterns on some journalists' devices in 2024, which continued into 2025. This led Al Jazeera to engage Citizen Lab for a more detailed investigation.
"Analysis of network logs provided to the Citizen Lab by Al Jazeera collected during the attack period provides a clear temporal signature of how the attack was executed," the report stated.
The "zero-click" nature means that a device becomes infected simply by displaying an infected advertisement, allowing for the spying and exfiltration of all available data.
Separately, New York-based security firm Confiant reported that some of Discover-Tech's advertisements were also found on networks used by the Pentagon, the International Atomic Energy Agency, and the International Criminal Court.
Candiru's spyware has previously been used for surveillance on at least 100 journalists, dissidents, and others across various countries.
