Citizen Lab says an Israeli ad firm’s auction bids carried zero-click spyware onto Al Jazeera devices

The Citizen Lab published a report on Thursday 15 October stating that at least 45 devices inside Al Jazeera were targeted during 2024 and 2025 with mercenary spyware it links “with high confidence” to Candiru — the Israeli vendor now rebranded as Integrity Labs, which the United States blacklisted in 2021. The delivery channel, the lab says, was online advertising purchased by Discover-Tech, an Israeli company that presents itself as an advertising business. Citizen Lab calls the technique AdFection and describes it as the first public confirmation of zero-click mercenary spyware delivered through targeted ads. Reuters, NBC News, Bloomberg and the Globe and Mail carried the findings independently of Al Jazeera, which is both the victim in the report and a publisher of the story: the network’s in-house technology team noticed unusual patterns on journalists' devices in 2024, saw them continue into 2025, and then approached the lab.

The mechanism runs through real-time bidding, the split-second auctions that decide which advertisement loads on a page or in an app. When a Discover-Tech ad rendered, according to the report, a script checked the device’s advertising ID and IP address; a device on the target list was served code that began the attack, and every other device got nothing back. Two consequences follow. No victim had to click anything, and the ad networks carrying the inventory never saw the malicious code. The report adds that users who were not targeted still had browser or app data, including their IP address, returned to Discover-Tech. NBC News reports the ads reached nearly 200,000 websites and apps. Citizen Lab says they were “shown on devices in national-security-sensitive networks around the world”; the Globe and Mail’s summary lists defence ministries, militaries, national cybersecurity agencies, media organisations and intergovernmental bodies including NATO.

Two cautions on the numbers in circulation. The claim that Discover-Tech ads also appeared in networks used by the Pentagon, the IAEA and the International Criminal Court comes from the New York ad-security firm Confiant, and reaches the public through Al Jazeera’s write-up of Confiant’s report rather than through the primary document. And The National’s framing of an operation against “hundreds of millions of people” is that outlet’s headline, not a Citizen Lab finding: the figures in the report are 45 targeted Al Jazeera devices and advertising reach across roughly 200,000 sites and apps. Citizen Lab’s own account of the evidence is narrower and more technical — “analysis of network logs provided to the Citizen Lab by Al Jazeera collected during the attack period provides a clear temporal signature of how the attack was executed.” Al Jazeera said the cooperation “helped verify and publicly document these attacks.”

Assessment: The report establishes a vendor and a delivery channel. It does not name the customer who directed the targeting of a Qatari-funded broadcaster, and that is the question with consequences; attribution to Candiru is a research institution’s confidence judgment, not a government finding. The more consequential test is commercial rather than diplomatic. If any exchange, demand-side or supply-side platform publicly names Discover-Tech and cuts it off, the story moves from spyware to the regulation of real-time bidding itself, an industry whose business model is precisely the device profiling the report describes. If the ad-tech industry is still silent by Monday, that silence is the finding. Watch also for a US Commerce or Treasury move on Integrity Labs, and for any European data-protection authority to take an interest in the advertising-ID profiling.