Israeli spyware infected millions of devices via zero-click ads
The Citizen Lab confirms Candiru malware targeted Al Jazeera and global networks through Discover-Tech advertisements without user interaction.
The Canadian cyber watchdog group The Citizen Lab reported that millions of devices were infected with Israeli mercenary spyware called Candiru. This infection occurred through zero-click digital advertisements in a campaign confirmed publicly on Thursday. The investigation marks the first instance of such spyware being delivered via targeted ads.
Discover-Tech, an Israeli company posing as a legitimate advertising firm, facilitated these attacks for partners like Candiru. The group placed targeted ads that directed devices in dozens of countries to contact malicious servers. These servers performed tracking and reconnaissance operations without requiring any action from the device users.
The Citizen Lab found that at least 45 devices linked to Al Jazeera Media Network were targeted between 2024 and 2025. These specific targets were hit through a series of zero-click ad attacks purchased by Discover-Tech. The spyware also targeted other media organizations across eight countries including Australia and Mexico.
Discover-Tech controls a platform named Controlium which allows mercenary partners to de-anonymize and fingerprint devices. The system automatically infects devices as soon as an advertisement is shown on the screen. This process occurs without the target having to click on the ad or download any files.
During a four-month period, the ads appeared on almost 200,000 unique websites and applications globally. Jerome Dangu of Confiant stated that hundreds of millions of people likely encountered these advertisements. The ads were displayed in sensitive networks including the Pentagon and the International Criminal Court.
Following the findings, Google and other major platforms disconnected Discover-Tech from the digital advertising market. Candiru was previously blacklisted by the US government in 2021 for activities contrary to national security interests. The firm later rebranded as Integrity Labs after being acquired by a US private equity firm.