MEFILES

Citizen Lab says an Israeli ad firm’s auction bids carried zero-click spyware onto Al Jazeera devices

A University of Toronto report published 15 October describes spyware delivered through real-time ad bidding to at least 45 devices inside Al Jazeera, with the vendor identified as the blacklisted Israeli firm Candiru.

The Citizen Lab published a report on Thursday 15 October stating that at least 45 devices inside Al Jazeera were targeted during 2024 and 2025 with mercenary spyware it links “with high confidence” to Candiru — the Israeli vendor now rebranded as Integrity Labs, which the United States blacklisted in 2021. The delivery channel, the lab says, was online advertising purchased by Discover-Tech, an Israeli company that presents itself as an advertising business. Citizen Lab calls the technique AdFection and describes it as the first public confirmation of zero-click mercenary spyware delivered through targeted ads. Reuters, NBC News, Bloomberg and the Globe and Mail carried the findings independently of Al Jazeera, which is both the victim in the report and a publisher of the story: the network’s in-house technology team noticed unusual patterns on journalists' devices in 2024, saw them continue into 2025, and then approached the lab.

The mechanism runs through real-time bidding, the split-second auctions that decide which advertisement loads on a page or in an app. When a Discover-Tech ad rendered, according to the report, a script checked the device’s advertising ID and IP address; a device on the target list was served code that began the attack, and every other device got nothing back. Two consequences follow. No victim had to click anything, and the ad networks carrying the inventory never saw the malicious code. The report adds that users who were not targeted still had browser or app data, including their IP address, returned to Discover-Tech. NBC News reports the ads reached nearly 200,000 websites and apps. Citizen Lab says they were “shown on devices in national-security-sensitive networks around the world”; the Globe and Mail’s summary lists defence ministries, militaries, national cybersecurity agencies, media organisations and intergovernmental bodies including NATO.

Two cautions on the numbers in circulation. The claim that Discover-Tech ads also appeared in networks used by the Pentagon, the IAEA and the International Criminal Court comes from the New York ad-security firm Confiant, and reaches the public through Al Jazeera’s write-up of Confiant’s report rather than through the primary document. And The National’s framing of an operation against “hundreds of millions of people” is that outlet’s headline, not a Citizen Lab finding: the figures in the report are 45 targeted Al Jazeera devices and advertising reach across roughly 200,000 sites and apps. Citizen Lab’s own account of the evidence is narrower and more technical — “analysis of network logs provided to the Citizen Lab by Al Jazeera collected during the attack period provides a clear temporal signature of how the attack was executed.” Al Jazeera said the cooperation “helped verify and publicly document these attacks.”

Assessment: The report establishes a vendor and a delivery channel. It does not name the customer who directed the targeting of a Qatari-funded broadcaster, and that is the question with consequences; attribution to Candiru is a research institution’s confidence judgment, not a government finding. The more consequential test is commercial rather than diplomatic. If any exchange, demand-side or supply-side platform publicly names Discover-Tech and cuts it off, the story moves from spyware to the regulation of real-time bidding itself, an industry whose business model is precisely the device profiling the report describes. If the ad-tech industry is still silent by Monday, that silence is the finding. Watch also for a US Commerce or Treasury move on Integrity Labs, and for any European data-protection authority to take an interest in the advertising-ID profiling.

Tehran says it can switch off Starlink terminals and will share the method with aligned states

Mohammad Amin Aghamiri, secretary of Iran’s Supreme National Cyberspace Council, called Starlink a “tool of war” and signalled a tiered-access model for future restrictions.

Al Jazeera reported on 14 October that Aghamiri described Starlink as a “tool of war” for Iran’s enemies and said: “We have several systems for cutting off Starlink satellite terminals.” He did not describe the systems. He said one had been deployed during the nationwide protests in January and that Iran was prepared to share the technology with aligned countries. He urged Iranians onto domestic platforms carried by the National Information Network and endorsed a tiered-access model under which selected categories — traders, researchers, journalists — would retain access to international services while restrictions applied to everyone else. Possession and distribution of Starlink terminals is already illegal in Iran, with penalties ranging from fines and imprisonment to heavier sentences where national-security or espionage charges are brought. An internet and telecommunications expert in Tehran, speaking anonymously to Al Jazeera, described jamming and GPS spoofing among the methods used against Starlink connections; that account rests on a single unnamed source.

The remarks sit against two nationwide shutdowns already imposed on a country of some 90 million people this year, by Al Jazeera’s count: roughly three weeks during the January protests, and 88 days beginning with the US-Israeli strikes of 28 February. Separately, Iran International — a London-based Persian-language channel that is itself a standing target of Iranian state operations and has documented Saudi funding links — said on 15 October that an unauthorised third party had accessed the work account of one of its correspondents on 10 October. The outlet says the correspondent was approached by someone posing as a representative of “an established think tank” and invited to an online meeting whose link led to a fraudulent sign-in page. It says the account was secured “in a timely manner,” that no other account appears to have been compromised, and that the attacker had access to emails and files “including internal newsgathering and planning material and personal information about some colleagues and people we work with.” Its judgment that the attack came from “actors linked to the Iranian regime” is the outlet’s own; no vendor report, government statement or technical indicator has been published.

Assessment: Aghamiri’s tiered-access proposal is the part to watch, not the anti-Starlink boast. A shutdown with licensed exemptions for traders, researchers and journalists converts an emergency measure into permanent architecture, and creates a register of who is permitted to see the outside world — a more durable instrument of control than an 88-day blackout, and a cheaper one economically. The export offer to “aligned countries” is unverified and names no recipient; treat it as positioning until one appears. On Iran International, the five-day gap between compromise and disclosure is unexplained, and the attribution comes from a party to the conflict reporting on its own incident. That does not make it wrong. It does mean it stays a claim until an independent researcher corroborates it.

Baku reports more than 100 state domains attacked as a pro-Iran group claims a hijab-ban reprisal

Azerbaijan’s communications security service says the attacks began at 22:00 on 13 October. It has not named a country, and the only attribution on offer comes from the attackers themselves.

Azerbaijan’s State Service for Special Communication and Information Security said on Wednesday 14 October that attacks on state information infrastructure began at around 22:00 local time the previous evening. “The attack, carried out by a foreign hacker group, targeted more than 100 state domains located within the state information infrastructure of the Republic of Azerbaijan,” the statement said, adding that it “has disrupted access to web resources belonging to several government bodies.” No country was named. An hour before the recorded start, at 21:00 Baku time on 13 October, a group calling itself 313 Team — described as pro-Iranian and believed to operate from Iraqi territory — posted on Telegram that it had “launched a massive, sophisticated cyberattack targeting 47 key IP ranges belonging to the Republic of Azerbaijan’s government digital infrastructure,” to run for 24 hours. Its stated motive was Azerbaijan’s ban on the hijab in schools and universities, over which it said it had “received numerous complaints.”

On 16 October Azerbaijan’s parliament said the country faces “intensified hybrid attacks” by “hostile forces operating from the territory of friendly and neighboring countries,” which it said aim to “inject their disinformation into digital platforms through channels that appear independent” and operate “by hacker groups, foreign media outlets, real and fake accounts, and bots.” The statement did not mention the hijab ban. It lands, as OC Media notes, during a public quarrel with Ankara over the same ban: on 13 October the ruling New Azerbaijan Party accused Turkish outlets and social platforms, including pro-government ones, of spreading false and biased information about Azerbaijan. For scale, a Sputnik/RIA Novosti report relayed by Bernama — a Russian state wire, and to be read as one — said hackers hit 22 Azerbaijani websites in late September.

Assessment: The outage is announced by the state, not independently measured; the attribution is asserted by the actor, not confirmed by Baku. Both halves are checkable. Forty-seven IP ranges, a hundred-odd domains and a 24-hour window leave a signature that external measurement would show, and nobody has published that check. The phrase “friendly and neighboring countries” is carrying the weight here: it points equally at Iran and at Turkey, and Baku has kept it that way on purpose. Naming Iran would be a policy decision rather than a technical one, and the simultaneous row with Ankara over the same hijab ban pulls against making it. Expect the ambiguity to hold as long as both quarrels are live.