Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that needed no click or other action from the user. The Citizen Lab, a research group at the University of Toronto, said Thursday that the attack code ran the moment an ad loaded, and in some cases the ad loaded out of sight in the background. It calls this the first public, technical confirmation that mercenary spyware has reached real devices through targeted ads. The method had been described before from leaked company documents, but not shown in a live attack.
The ads were placed by Discover-Tech, an Israeli company that presents itself as a normal advertising firm. According to The Hacker News’ summary of the report, each ad carried a small piece of code that sent the device’s advertising ID and internet address to a Discover-Tech server. That server decided whether the device was a target and sent attack code only if it was. Because the ad itself held no attack code, the networks that delivered it had nothing harmful to detect. At least 45 Al Jazeera devices were targeted in 2024 and 2025, and the Citizen Lab linked the attacks to Candiru with high confidence, partly because a Windows file pulled from a compromised device reused techniques from a Candiru tool the lab analyzed in 2021. The researchers recovered the spyware but not the exploit that breaks into the browser or app, and they did not say which government was behind the operation.
The reach was wide. On one platform Discover-Tech placed nearly four billion ad bids between March and June 2026, with the callback code appearing in about 75,000 phone apps and 120,000 websites, and the security firm Confiant, which investigated alongside the Citizen Lab, put its traffic at roughly 10 million ads a day. After the researchers shared their findings, Google and IAB Europe removed Discover-Tech from their vendor lists in early October, and several ad exchanges cut its access. The Hacker News reported that Discover-Tech’s website was still online on Thursday and said nothing about the findings. This is a different method and a different vendor from the iMessage-based Pegasus case in our September report on a Serbian student.
How to check if you’re affected
Affected devices are phones, tablets and computers that loaded ads served through Discover-Tech, which no ordinary user can see directly. The Citizen Lab and Confiant published indicators for organizations whose staff may have seen the ads, especially journalists, activists and officials who are plausible spyware targets.
- Search DNS and proxy logs for the connection order seen on infected devices: a Discover-Tech ad server, then a Candiru screening server, then a command-and-control server.
- Block and search for the published indicators, including the domain
mtrtb[.]com(Discover-Tech ad server) and the SHA-256 of the recovered spyware sample,255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8. The full list, including command-and-control servers, is in Confiant’s report. - High-risk users should keep browsers, phone operating systems and apps updated, since the break-in step runs in the browser or an app. The researchers did not publish the exploit, so no specific patched version is known.