From CitizenLab and Middle East Eye:
Millions of people have been affected, including Al Jazeera devices, by first-ever zero-click spyware delivered through advertisementsThe Citizen Lab found that in 2024 and 2025, at least 45 devices within Al Jazeera were targeted in ad attacks by Israeli company Discover-TechMillions of people's devices have been infected with Israeli commercial spyware called Candiru through zero-click digital advertisements, Canadian cyber watchdog group The Citizen Lab found in an investigation.
The case marks the first zero-click mercenary spyware, confirmed publicly, delivered through targeted ads, the group said in a report published on Thursday. The spyware also targeted devices linked to Al Jazeera Media Network.
Mercenary spyware is a highly advanced, custom-built form of malware created by private companies and sold to paying clients, including states.
Discover-Tech, an Israeli company that presents itself as a legitimate ad company but in reality operates for Israeli spyware partners like Candiru, placed targeted ads that directed millions of devices in dozens of countries to contact Candiru's servers for tracking and reconnaissance, according to the report.
The Citizen Lab found that in 2024 and 2025, at least 45 devices within Al Jazeera were targeted in a series of zero-click ad attacks purchased by Discover-Tech.
Discover-Tech controls a platform called Controlium that allows "mercenary partners to de-anonymize, fingerprint, and automatically infect devices" as soon as the ad is shown, without having the target even click on it.
During a four-month period, Discover-Tech's ads were shown on almost 200,000 unique websites and Android/iOS apps in dozens of countries.
Aside from Candiru, rebranded as Integrity Labs, Discover-Tech is also linked to other mercenary spyware actors, including Intelos and Bindecy.
'A systemic security threat''
Candiru was blacklisted by the US government in 2021 for "engaging in activities contrary to the national security or foreign policy interests of the United States". Candiru's rebrand came after it was acquired by US private equity firm Integrity Partners in 2025, which is not sanctioned by the US.
Discover-Tech has appeared as a "certified and "approved" vendor operated by Google and the advertising industry association IAB Europe, and has plac
Post too long. Click here to view the full text.