Forty-five Al Jazeera devices were hit through ad auctions, and Doha has said nothing

Citizen Lab’s “Exposing AdFection” report, published 15 October and filed by Reuters the same day, documents at least 45 devices at Al Jazeera targeted with Candiru spyware delivered through advertisements placed by Discover-Tech Ltd across 2024 and 2025. The researchers describe it as the first public technical confirmation of a zero-click mercenary spyware attack delivered via targeted advertising. Discover-Tech’s ads reached more than 120,000 websites and 75,000 apps through its partnerships; Jerome Dangu, co-founder of the ad-security firm Confiant, told Reuters the company was pushing “at least 10 million ads per day” worldwide, with cookie-matching arrangements extending tracking beyond its own inventory. Citizen Lab also names a related entity, “Dark Cartographer,” which it says built databases linking mobile advertising identifiers to phone numbers by exploiting carrier vulnerabilities.

The dates are the story. Discover-Tech Ltd was registered in March 2020 and added to Google’s Ad Manager Certified External Vendors list on 1 November 2020. Candiru — now rebranded Integrity Labs — was placed on the US Commerce Department Entity List on 3 November 2021. The certification survived that listing by almost five years. Google told Reuters it removed Discover-Tech “for systematically violating our policies”; IAB Europe told The National it suspended the firm after an audit found policy breaches, delisting it from the Global Vendor List on 8 October. Comcast, which owns Beeswax, acted “following recent activity”; Vungle paused access pending review and Eskimi blocked the accounts. Wolfie Christl — bylined by Reuters to Citizen Lab, though he is more commonly identified with Cracked Labs in Vienna — said: “The way online advertising works today is a systemic security threat.”

Assessment: Treat anything appearing on this today as retelling, not news; the enforcement actions it reports are twelve days old. The live thread is institutional. Citizen Lab has asked regulators to examine whether Discover-Tech or Candiru broke the law, and neither company has been heard from. Watch three doors: an Israeli export-licence response, an Irish DPC or FTC move on real-time bidding, and whether any exchange beyond Google, Beeswax, Vungle and Eskimi follows. The loudest absence is Doha’s. Forty-five devices at Al Jazeera were compromised and the network has issued nothing. Silence from a state-funded broadcaster is a political position, not an oversight.