Discover-Tech Ads Delivered Candiru Spyware to Al Jazeera

Discover-Tech, an Israeli advertising company, used targeted online ads to infect at least 45 devices at Al Jazeera with Candiru spyware between 2024 and 2025, according to Citizen Lab. The campaign, known as AdFection, required no action from the targeted users.

The Canadian digital rights group found that Discover-Tech’s Controlium platform connected advertising companies with commercial spyware vendors. Its ads contained code that contacted Discover-Tech servers, sent advertising identifiers and ran JavaScript selected using data such as IP addresses and device identifiers.

The system could identify and track devices through real-time bidding, in which advertisers compete in large numbers of auctions to display ads. Advertising exchanges collect data about users, devices and browsing activity. Code in ads can run inside applications and web browsers, where it is usually used to measure views and clicks.

Citizen Lab identified a Discover-Tech server containing about 4 billion records from advertising bids. The records indicated that the company’s ads appeared on nearly 200,000 websites and Android and iOS applications worldwide.

The group found that Discover-Tech’s advertising infrastructure could help spyware operators select specific targets. In the Al Jazeera cases, the targeted ads led to Candiru spyware infections on at least 45 devices.

Citizen Lab also connected Discover-Tech to a surveillance operation called Dark Cartographer. The operation was creating databases that linked mobile advertising identifiers to phone numbers by exploiting weaknesses at mobile carriers, according to the group. That process could identify large numbers of internet users.

Google and IAB Europe removed Discover-Tech from their advertising vendor registries in early October, according to Citizen Lab. Google also blocked the company from its ad exchange platforms. Beeswax and Eskimi took similar actions.

“Given the current threat posed by Discover-Tech’s AdFection vectors, and the evidence of wide-scale targeting, we judge that the most feasible protection is for defenders to block targeted ads at the gateway,” Citizen Lab wrote. The group recommended keeping that measure in place until the advertising industry can reliably block similar attack methods.