Ethical Hacking News
A sophisticated Candiru spyware attack was carried out through targeted online ads on the Al Jazeera news network, in collaboration with the Israeli company Discover-Tech. The attack, which was made possible through zero-click attacks, infected at least 45 devices in 2024 and 2025. The discovery highlights the need for greater scrutiny of the ad-buying system and the companies that operate within it. Google and IAB Europe have removed Discover-Tech from their vendor lists, but the attack serves as a stark reminder of the ever-evolving threat landscape of cyber espionage.
Researchers at Citizen Lab discovered a zero-click Candiru spyware attack carried out through targeted online ads on Al Jazeera news network. The attack, carried out by Discover-Tech, infected at least 45 devices in 2024 and 2025 without requiring user interaction. The attack was made possible by the collaboration between Citizen Lab and Al Jazeera, who provided traffic logs that helped identify the sequence of events leading to device infections. The attack highlights the ever-evolving threat landscape of cyber espionage and the risks associated with the ad-buying system. Discover-Tech was removed from ad-buying vendor lists by Google and IAB Europe after the discovery, with some companies pausing access to its accounts for review. The discovery emphasizes the importance of monitoring and analyzing ad traffic to identify potential threats.
The recent revelations by the Citizen Lab, a research group at the University of Toronto, have shed light on a sophisticated and insidious threat to the security of online devices. In a shocking turn of events, the lab has identified a zero-click Candiru spyware attack that was carried out through targeted online ads on the Al Jazeera news network, in collaboration with the Israeli company Discover-Tech. This attack highlights the ever-evolving threat landscape of cyber espionage, where malicious actors have found new and innovative ways to infiltrate devices without the need for user interaction.
The discovery was made possible by the collaboration between the Citizen Lab and Al Jazeera, who provided the researchers with their traffic logs. By analyzing these logs, the researchers were able to piece together the sequence of events that led to the infection of at least 45 devices in 2024 and 2025. The first step in this sequence involved the loading of a Discover-Tech ad on the device, which carried a small piece of code that sent the device's advertising ID and internet address back to a Discover-Tech server. The server then decided whether the device belonged to a target, and if so, sent back attack code for the browser or app to run.
This attack is particularly insidious because it does not require the user to click on the ad or engage in any other action. The ad itself carries no attack code, and the ad networks that deliver it have nothing harmful to detect. This means that even if an ad appears on a network, it does not necessarily mean that the device was infected. However, the sheer number of ads that were placed by Discover-Tech, with nearly four billion ad bids between March and June 2026, increases the likelihood that some of these ads may have carried the hidden callback code.
The impact of this attack goes beyond the Al Jazeera news network, as the ads carrying the hidden callback code appeared in about 75,000 phone apps and 120,000 websites. Confident, a U.S. ad-security firm that investigated alongside the Citizen Lab, put Discover-Tech's traffic at roughly 10 million ads a day. This means that the attack could have affected a significant number of devices, including those belonging to governments and large institutions.
The discovery of this attack has significant implications for the security of online devices and the ad-buying system. Security researchers have warned for years that the ad-buying system could be turned to this use, and this latest discovery is a stark reminder of the risks associated with the exploitation of this system. The use of zero-click attacks, where the user is not required to take any action to infect their device, is a particularly insidious threat that can be difficult to detect.
The attack also highlights the issue of trust in the ad-buying system. Google and the advertising trade group IAB Europe had both listed Discover-Tech as an approved ad vendor from 2020 until this month. The company was registered in Israel in 2020 and is led by its chief executive, Dekel Boni. The fact that Discover-Tech was able to operate under the radar for so long highlights the need for greater scrutiny of the ad-buying system and the companies that operate within it.
The impact of this attack is also felt by the Russian ad network Yandex, which did not respond to Reuters. Discover-Tech's website was still online on Thursday and said nothing about the findings. The lack of response from these companies highlights the need for greater accountability and transparency in the ad-buying system.
In the aftermath of this discovery, Google and IAB Europe removed Discover-Tech from their vendor lists in early October, the Citizen Lab said. Google cut off the company's access to its ad exchanges, Beeswax removed it, Vungle paused its access for a review, and Eskimi blocked its accounts. The removal of Discover-Tech from the ad-buying system is a significant step towards mitigating the impact of this attack.
The discovery of this attack also highlights the importance of monitoring and analyzing ad traffic. The Citizen Lab has recovered the spyware itself from one device, but not the exploit that breaks into the browser or app to install it. The fact that the researchers were able to recover the spyware itself highlights the importance of monitoring ad traffic and analyzing it for potential threats.
The discovery of this attack is a stark reminder of the ever-evolving threat landscape of cyber espionage. As security researchers continue to uncover new threats and vulnerabilities, it is essential that we prioritize the security of our online devices and the ad-buying system. By working together to identify and mitigate these threats, we can reduce the risk of attacks like this and protect our devices from falling prey to malicious actors.
Related Information:
https://www.ethicalhackingnews.com/articles/Candiru-Spyware-Tainted-Ad-Network-Leverages-Zero-Click-Attacks-to-Infect-Devices-at-Al-Jazeera-and-Beyond-ehn.shtml
https://thehackernews.com/2026/10/citizen-lab-traces-zero-click-candiru.html
Published: Thu Oct 15 17:20:46 2026 by llama3.2 3B Q4_K_M
