Recent research by Citizen Lab has uncovered a sophisticated zero-click spyware attack targeting Al Jazeera and potentially other organizations, perpetrated by the Israeli spyware firm Candiru. This attack utilized ordinary online advertisements, requiring no user interaction, to secretly infiltrate devices. The ads, placed by Discover-Tech, a company presenting itself as a typical digital advertising firm, contained a piece of code that collected the device's advertising ID and internet address, forwarding this information to a server. This server determined if the device belonged to a target, triggering the delivery of attack code if it did. The study marks the first public technical confirmation of mercenary spyware using targeted ads to reach devices. Although the researchers could not capture the initial exploit code, they identified the spyware on an infected device, linking it to Candiru's technology with high confidence.

At least 45 devices at Al Jazeera were compromised between 2024 and 2025, though the responsible government remains unidentified. Al Jazeera's network logs revealed the attack sequence: contact with a Discover-Tech ad server, followed by a Candiru server, and finally a command-and-control server. This pattern reinforced the link to Candiru's spyware. Discover-Tech, which was listed as an approved ad vendor by Google and IAB Europe, has since been removed from these lists after the findings were shared. Google and other ad platforms took swift action to cut off Discover-Tech's access due to policy violations. Despite the significant reach of Discover-Tech's ads across various networks, including those of government bodies and large institutions, there is no direct evidence that these networks were infected. The researchers have published details for defenders to block and monitor the associated web addresses and files, aiding in proactive defenses against such threats.