Researchers say ads delivered zero-click spyware to Al Jazeera devices

Researchers at the University of Toronto's Citizen Lab say targeted online advertising has become a new delivery route for commercial spyware. In a report published on Thursday, they called it the "first public technical confirmation" of a zero-click attack carried out this way. According to the researchers, at least 45 devices at broadcaster Al Jazeera were targeted in 2024 and 2025 with spyware made by Israel's Candiru. Reuters reported that the devices were Windows computers. The U.S. Commerce Department blacklisted Candiru in 2021.

The researchers say the ads were delivered through Israeli advertising firm Discover-Tech. Its Controlium platform allegedly identified individual devices as an ad was displayed and decided whether to infect them. Together with security firm Confiant, the researchers analyzed nearly 4 billion ad bidding records, which showed Discover-Tech ads running on nearly 200,000 websites and apps in dozens of countries. Networks linked to the Pentagon, NATO, the U.N. and the European Commission also appear in the data.

Google said it removed Discover-Tech "for systematically violating our policies." IAB Europe and Comcast's Beeswax ad platform also dropped the firm. Discover-Tech did not respond to Reuters' requests for comment, and neither did Candiru's owners. Citizen Lab senior researcher Wolfie Christl told Reuters that online advertising today is a systemic security threat.