The Invisible Breach: How Mercenary Spyware Weaponized the Global Ad-Tech Ecosystem

In a chilling development that marks a new frontier in cyber-espionage, researchers at The Citizen Lab have confirmed that mercenary spyware developed by the Israeli firm Candiru has been successfully deployed against targets—including the Al Jazeera news network—using nothing more than ordinary online advertisements.

This breakthrough, which researchers describe as the first public, technical confirmation of "malvertising" being used to deliver high-end spyware, represents a paradigm shift in how government-grade hacking tools reach their victims. Unlike traditional phishing campaigns that require a target to click a malicious link or open an infected attachment, this method relies on "zero-click" architecture. The infection occurs the moment an advertisement loads in a browser or mobile app, sometimes even when the ad is rendered in the background, entirely out of the user’s sight.

The Mechanics of the "Silent" Attack

The sophistication of this operation lies in its ability to exploit the trust inherent in the global programmatic advertising ecosystem. The attack was facilitated by Discover-Tech, an Israeli advertising firm that operated as a seemingly legitimate vendor.

The Anatomy of the Pipeline

The process functioned as a multi-stage funnel designed to maximize stealth:

Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads

The Trigger: When a target visited a website or opened an app, a standard ad space was filled by a banner served through Discover-Tech.
The Fingerprint: Embedded within the ad’s code was a small, innocuous-looking script. As soon as the ad loaded, this script transmitted the device’s unique advertising ID and IP address to a server controlled by Discover-Tech.
The Screening: This server acted as a sophisticated filter. It cross-referenced the device’s metadata against a pre-selected list of high-value targets.
The Payload: If the device matched the profile of a target, the server responded by pushing malicious exploit code directly to the browser or application. If the device was deemed "uninteresting," the server remained silent, effectively hiding its malicious infrastructure from researchers and automated security scanners.

Because the initial ad itself contained no harmful code, traditional ad-network security filters—which scan for malicious payloads—saw nothing suspicious. The "weapon" was only assembled on the victim’s device after the initial screening process confirmed the target’s identity.

A Chronology of the Espionage Campaign

The investigation, which spanned several months, revealed a systematic effort to compromise journalists and staff at Al Jazeera throughout 2024 and 2025.

Early 2024 – Early 2025: Researchers identified a persistent campaign targeting at least 45 devices linked to Al Jazeera. Traffic logs obtained from the network provided the "smoking gun," showing a consistent, three-stage connection pattern: an initial handshake with a Discover-Tech ad server, a secondary validation through a Candiru screening server, and finally, a connection to a command-and-control (C2) server that executed the final spyware payload.
October 2026: Following the disclosure of the findings by The Citizen Lab and their partners at Confiant, a major industry cleanup ensued. Major ad exchanges, including Google and Beeswax, terminated their relationship with Discover-Tech.
Post-Discovery: The broader security community began analyzing the sheer scale of the reach, discovering that the malicious infrastructure had been embedded in over 75,000 mobile applications and 120,000 websites.

This incident is not the first time Al Jazeera has faced such threats. In 2020, the network was the subject of a massive, separate campaign involving NSO Group’s Pegasus spyware, which utilized different, albeit equally sophisticated, delivery vectors.

Supporting Data: The Scale of the Malvertising Infrastructure

The sheer volume of traffic processed by Discover-Tech highlights the dangerous intersection of digital advertising and state-sponsored espionage. According to data provided by the Citizen Lab, Discover-Tech placed nearly four billion ad bids between March and June 2026 alone.

Confiant, a firm specializing in ad-tech security, estimated that the infrastructure was handling roughly 10 million ad impressions per day at its peak. While the vast majority of these impressions were benign, the potential for mass surveillance was unprecedented.

Widespread Exposure

The reach of the Discover-Tech network extended to the most sensitive institutions in the world. Analysis showed that these "callback" ads were served to networks belonging to:

International Organizations: The United Nations and various European Union bodies.
Defense Alliances: NATO-associated networks.
Governmental Entities: Offices across approximately two dozen countries.
Private Sector: Leading global chip manufacturers and major news organizations.

It is critical to note, however, that the presence of an ad on a network does not equate to a successful infection. The screening process was highly selective, likely reserving the expensive "zero-day" exploit payloads for only the most high-value individuals within these organizations.

The Players: Candiru and the Mercenary Spyware Market

The spyware in question is the product of Candiru, a firm that has long operated in the shadows of the "mercenary" cyber-intelligence market.

The Evolution of Candiru

Candiru gained international notoriety in 2021 when it was placed on the U.S. Commerce Department’s Entity List for providing spyware used to target activists, journalists, and government officials. Despite these sanctions, the firm proved resilient. In 2025, its assets were acquired by a U.S. investment firm, Integrity Partners, and reorganized under a new entity, reported to be Integrity Labs. This corporate restructuring allowed the technology to circumvent certain trade restrictions, highlighting the "whack-a-mole" nature of regulating the spyware industry.

The Role of Discover-Tech

Discover-Tech acted as the essential bridge between the ad-tech world and the spyware world. By masquerading as a legitimate digital advertising vendor, the company managed to maintain "approved" status on major ad exchanges operated by Google and IAB Europe for over five years, from 2020 until October 2026. Their CEO, Dekel Boni, has yet to provide a public comment regarding the allegations.

Official Responses and Remediation

The fallout from the disclosure has been swift. Major technology players were forced to confront the vulnerability of their automated ad-delivery systems.

Google’s Stance: A spokesperson for Google confirmed the company had removed Discover-Tech from its ad exchanges for "systematically violating our policies." The company cooperated with the researchers to ensure that the malicious infrastructure was effectively neutralized.
IAB Europe: The advertising trade group, which sets standards for the industry, suspended Discover-Tech after an audit confirmed the policy violations uncovered by the researchers.
Industry Action: Platforms like Beeswax and Vungle took immediate steps to block access to Discover-Tech’s services, while others like Eskimi moved to suspend accounts, effectively cutting off the pipeline for the spyware distribution.

Implications for Global Security

The implications of this discovery are profound and unsettling for both the cybersecurity industry and the general public.

The Erosion of "Trust-by-Design"

The entire modern web is built on a model of programmatic advertising where ad-tech vendors are trusted to serve content to billions of users. This attack demonstrates that this trust is a systemic vulnerability. When a spyware vendor can "buy" their way into the advertising ecosystem, they can reach almost any target on the planet without the victim ever needing to interact with a malicious link.

The Challenge for Defenders

For security teams, the challenge is now significantly harder. Traditional defenses focus on blocking known malicious domains or suspicious file downloads. However, when the attack arrives via a legitimate, trusted ad network, traditional indicators of compromise (IoCs) become much less effective. The only way to detect such an attack is through deep packet inspection of the order of connections—specifically looking for the pattern of Ad-Server to Screening-Server to C2-Server.

The Future of Spyware

This development serves as a stark reminder that as digital defenses improve, the "mercenary" spyware industry is evolving toward more passive, harder-to-detect vectors. The existence of similar tools—such as the "Aladdin" tool linked to the spyware vendor Intellexa—suggests that the use of ad-tech as an infection vector is not an isolated incident but an emerging trend in the global espionage market.

As we move forward, the burden of protection is shifting from the individual user to the gatekeepers of the internet. If the ad-tech industry cannot guarantee the integrity of the code flowing through its pipelines, the cost of browsing the web may be a compromise of our most sensitive, private information. For now, the researchers at The Citizen Lab have provided the roadmap for detection, but the battle to secure the digital ecosystem against such "silent" threats has only just begun.