Citizen Lab: Al Jazeera Devices Targeted by Candiru Spyware Through Targeted Ads

Candiru spyware was reportedly used in zero-click attacks against devices belonging to the media organization Al Jazeera, according to a technical analysis by Citizen Lab. On October 15, 2026, researchers said they had recorded at least 45 targeted devices in 2024 and 2025. Candiru spyware was reportedly delivered through targeted online advertising from Discover-Tech without the user clicking on the ad.

Citizen Lab describes the case as the first public technical confirmation of commercial zero-click spyware being delivered through targeted advertising. The findings are based on network logs that, according to researchers, capture a sequence involving Discover-Tech’s advertising infrastructure, a Candiru validation server, and subsequent communication with a command-and-control server for the compromised device, known as C&C.

Candiru spyware and the Controlium platform

According to Citizen Lab, Discover-Tech operated the Controlium platform, which enabled device profiling. For selected targets, it reportedly delivered malicious code after an ad was displayed. The essence of a zero-click attack is that the victim does not have to open an attachment, click a link, or otherwise knowingly interact with the content.

Ads are routinely displayed in mobile apps and on websites through a large network of advertising intermediaries. Citizen Lab therefore warns that the advertising ecosystem may be used not only to track and profile users, but also to precisely target devices for compromise.

Researchers say they link the attacks to Candiru with a high degree of confidence, specifically based on the timing of individual records in network traffic. Candiru is associated with commercial spyware. Citizen Lab also mentions Integrity Labs, which it identifies as Candiru under a new name.

Advertising platforms revoked or suspended access

Several advertising companies took action against Discover-Tech in connection with the case. Google terminated the company’s access to its ad exchanges. Beeswax removed it, Liftoff/Vungle suspended its access, and Eskimi blocked the company’s accounts and domains.

These measures concern Discover-Tech’s access to the platforms listed above. According to the available findings, the widespread display of its ads in apps, on websites, or across various organizations’ networks does not automatically mean that users’ devices were compromised.

Not a single CVE fix

The case does not describe a single publicly identified CVE vulnerability for which a universal security patch exists. Citizen Lab documented specific attacks, but the available information does not indicate a single remediation package that could generally eliminate this method of spyware delivery.

The greatest risk from this type of targeted surveillance concerns journalists, activists, diplomats, and others who are more likely to be of interest to espionage actors. The case also undermines the common security assumption that users can protect themselves from malicious content simply by not clicking suspicious links.

The party that commissioned the attacks remains unknown

It has not been confirmed which state or other Candiru customer ordered the attacks against Al Jazeera. According to secondary reporting, neither Discover-Tech nor Integrity Labs provided comment.

Further developments could include potential investigations by regulators into Discover-Tech, Candiru, or advertising-auction intermediaries. Citizen Lab also announced additional findings concerning an actor identified as DARK CARTOGRAPHER and the mass deanonymization of users. It will also be important to see whether other advertising platforms publish the results of their own reviews or indicators of compromise, and whether the identity of the party that commissioned the attacks is independently confirmed.

Verified and updated: October 18, 2026 06:21