An Israeli company that Google and the ad-industry group IAB Europe had listed as an approved vendor since 2020 bought online ads that put Candiru spyware on Al Jazeera devices with no click from anyone, researchers at the Citizen Lab said on Thursday.
At least 45 of the broadcaster’s devices were targeted in 2024 and 2025, according to the report by Bill Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis and Ron Deibert of the lab, which is based at the University of Toronto. They called it the “first public technical confirmation of a zero-click mercenary spyware attack delivered via targeted advertising.” Dan Goodin wrote in Ars Technica that it was likely the first confirmed case of its kind.
The company, Discover-Tech, passed the ad industry’s checks, and the record shows why. Google’s vendor list and IAB Europe’s registry confirm that a company has disclosed how it handles personal data under European privacy law, according to their own published requirements, and neither describes a security review. The ads carried nothing a scanner could flag. A Discover-Tech server decided, one device at a time, whether to send attack code or an empty reply.
The sanctions did no better. The United States blacklisted Candiru in 2021, and by 2025 its operations had been sold to an American fund and moved into a new entity outside the sanctions, the Israeli business daily Calcalist reported. Discover-Tech itself was never listed.
The operation ran at industrial scale. Between March and June, Discover-Tech placed 3,770,286,576 bids in ad auctions and won 441,954,291, reaching people in 161 countries through 75,373 apps and 120,768 websites, and some of those ads loaded inside networks at NATO, the United Nations and the European Parliament. Seeing one of the ads did not mean a device had been hacked, the researchers said.
How an ad becomes an exploit
When Discover-Tech won an auction, the ad it placed held a script that called a Discover-Tech server, which the company called NOAS, and handed over the device’s advertising identifiers. If the device was on a customer’s list, the server sent back JavaScript that ran on its own. Every other device got what the report called “a 0-byte response.” Some ads rendered in the background, where no one would see them.
That design let the company avoid “directly sharing malicious code, or even pointers to malicious code” with the exchanges that carried its ads, the researchers wrote, as The Record reported. Mr. Marczak, a senior researcher at the lab, told Wired that a victim “would not see anything amiss.” He added, “In fact, they might not even see any ad at all.”
Al Jazeera’s technical staff first noticed unusual patterns on some journalists’ devices in 2024, and the pattern continued into 2025, the network reported. The logs it gave Citizen Lab showed the same order every time. First came contact with a Discover-Tech domain, meaning an ad had loaded. Then came a Candiru “validator” server that checked the device, and then a Candiru command-and-control server once the device was infected.
Al Jazeera also pulled a Windows file off a compromised machine. It hard-coded two command servers and shared habits with the Candiru sample Citizen Lab captured in 2021, among them a 48-byte repeating XOR key to hide its text and connectivity checks against google.com and microsoft.com, in that order. According to Al Jazeera, the spyware can collect files, saved passwords and browser cookies, log keystrokes, take screenshots and record from the microphone and webcam.
Mr. Scott-Railton, a senior researcher at the lab, walked through the sequence on X the day the report came out, in a thread aimed at people who might be on the receiving end.
2/ How do you get hacked with AdFection?
Simple. You are browsing or using an app and an ad is shown. You don’t notice it.
You were silently selected.
Israeli intermediary Discover-Tech bid on you to make sure you saw it.
Behind the scenes the ad is running code for a…
The report does not name the vulnerabilities used or the final malware. Mr. Goodin wrote that the flaws were likely zero-days that have since been fixed.
A buyer that never sold anything
The lab’s figures come from Discover-Tech’s own buying platform, MyDSP, over four months. Of the 3,770,286,576 bids, 76.7 percent were for space inside mobile apps. Yandex, the Russian internet company, handled 67.4 percent of them, Google Ad Manager 24.74 percent and Vungle, owned by Liftoff, 7.24 percent.
About 19 percent of the bids, 718,748,885, were for ads carrying the NOAS script. Yemen drew the most, 457,283,658. Montenegro had the highest rate per person.
For all that activity, the company spent about $109,091, recorded no conversions (the purchases or sign-ups advertisers pay to produce) and logged revenue for only three days. “It is highly unusual for an ad vendor that not a single ad leads to such an action,” the researchers wrote. They found no evidence that Discover-Tech did any legitimate advertising work.
Confiant, a New York ad-security company that investigated in parallel and published its own findings, estimated the volume at roughly 10 million impressions a day. Jerome Dangu, Confiant’s co-founder and chief technology officer, told Reuters that “very likely hundreds of millions of people would have been touched by Discover-Tech.” He also said, “You go to almost any site in Palestine, any site, you find a Discover-Tech ad.”
The ads turned up on networks belonging to NATO, the United Nations, the European Parliament, the European Commission and the General Secretariat of the Council of the European Union. They also reached Norway’s Parliament and police, the Swedish Armed Forces, Denmark’s national rail operator, Australian nuclear research bodies, election authorities in Armenia, Indonesia and Mexico, and government networks in 24 countries. Confiant added the U.S. Defense Department, the International Atomic Energy Agency and the International Criminal Court.
Both groups said exposure was not infection. The traffic Confiant could tie directly to Candiru ran from hundreds to the low thousands of impressions a day, mostly on home and mobile connections rather than institutional networks. Belgium accounted for 56 percent of it.
The company behind the ads
Discover-Tech was registered in Israel in March 2020, with its chief executive, Dekel Boni, as its first director and sole shareholder, according to the report. Eric Banoun, whom Haaretz has called “one of the pioneers of offensive cyber in Israel,” sat on its board from 2020 to 2025. Until March 2026, one shareholder was a company linked to Sara Hamou, who has managed the corporate network of the spyware group Intellexa.
The researchers described Discover-Tech as a bridge between mainstream ad exchanges and the spyware trade and wrote that “it appears that serving as this bridge is Discover-Tech’s primary purpose.” Mr. Boni did not answer a LinkedIn message or emails from Reuters.
Much of what the lab learned came from the company’s own mistakes. Its targeting platform, Controlium, let customers aim “controlled ads” at a mobile advertising ID, a browser cookie or an IP address, and its code included the line “ONLY DEKEL IS ALLOWED!!!” An unprotected download page exposed 128 days of login records for 120 usernames, with logins from Israel, Europe and the Persian Gulf.
Two Candiru pre-sales accounts logged in from eight countries, including Azerbaijan, Mexico, the United Arab Emirates and the United States. A parameter on one Candiru infection link decoded to an IP address registered to Saudi Arabia’s Ministry of Foreign Affairs. Citizen Lab said it still could not attribute the Al Jazeera attacks to a specific customer.
Candiru was not the only client. The lab tied Controlium accounts to Bindecy, a hacking company whose operators logged in from seven countries, and to Intelos, an ad-intelligence firm in which Mr. Banoun has held shares since 2018. A third actor, which the lab calls Dark Cartographer, used Discover-Tech’s infrastructure to match advertising IDs to phone numbers by exploiting flaws at carriers in more than 30 countries since at least 2019, and its infrastructure links to a U.S. government contractor. Bindecy and Intelos did not respond.
What the approvals checked
Google keeps a list of ad technology partners that publishers in Europe choose from, and it blocks vendors that aren’t on it. A company already registered with IAB Europe can join through a simplified verification that takes up to two weeks. The form asks for a legal name, contact details, the IAB registration number, a privacy policy link, a description of the technology, the company’s domains and acceptance of Google’s platform policies. It describes no security review.
Google says it scans for policy and consent approvals at the domain level. Any scan of a Discover-Tech ad would have met a short script calling a server that, for nearly everyone, returned nothing. Confiant wrote that the company obfuscated its code “just enough that it looks in line with what can typically be found flying around in ad tech.”
Frank Dickson of Dickson Research explained the problem to Computerworld, which reported that the vendor vetting often amounted to self-attestation.
Third-party verification scanners saw a harmless banner, because for nearly every viewer, it was one.
IAB Europe runs the Transparency and Consent Framework, which carries Europeans’ privacy choices into ad auctions, and its Global Vendor List names the companies those choices cover. When a visitor in a GDPR region loaded Discover-Tech’s tracking pixel, it processed consent signals through the framework for three vendors, Discover-Tech, Xandr and Beeswax, according to the report. It also swapped user identifiers with Yandex, Beeswax and Xandr.
The limits of IAB Europe’s role were drawn in court. Belgium’s data protection authority fined the group 250,000 euros in 2022. On May 14, 2025, the Brussels Market Court upheld the fine but held that IAB Europe was responsible only for processing the consent strings, not for what companies later did in the auctions, the law firm Freshfields wrote.
The group stayed inside those limits on Thursday. In a statement, it said it was “not equipped or mandated to independently investigate conduct falling outside the substantive scope of the TCF” and would follow the work of the relevant authorities.
Citizen Lab read the same facts as an indictment of the system.
Discover-Tech’s mass abuse, privacy invasion, and facilitation for mercenary spyware attacks illustrates structural flaws with the online advertising system, which failed to detect or prevent the abuse documented in this report.
Mr. Dangu said the industry had built its defenses against a different enemy. It “has optimized against cyber criminals, scams and malware for profit,” he told CyberScoop, “but not for surveillance.”
The report drew 583 comments on Hacker News, and one reader there pointed to the incentives.
Google, which worked with the researchers, said it had removed Discover-Tech “for systematically violating our policies,” cut its access to Google’s ad exchanges and added warnings for websites linked to the group. IAB Europe suspended it after an audit found violations of the framework’s rules. Beeswax, owned by Comcast, removed the company “following recent activity.” Vungle paused its access pending a review, and Eskimi blocked its accounts and domains. Google and IAB Europe both acted in early October, after the researchers came to them. Citizen Lab contacted 13 companies in all, and Xandr did not respond in time.
Sanctions with a gap
On Nov. 3, 2021, the Commerce Department added Candiru and NSO Group to the Entity List, citing evidence that they “developed and supplied spyware to foreign governments that used these tools to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers.” Listed companies face a presumption of denial when they seek licenses for items covered by U.S. export rules, CyberScoop reported at the time.
The rule limits what American suppliers may ship to Candiru. It does not reach an Israeli middleman buying ad impressions on the spyware maker’s behalf.
On April 2, 2025, Calcalist reported that Candiru’s operations had been sold to Integrity Partners, a U.S. investment fund, for up to $30 million, with the staff moved to a new entity not subject to American sanctions. The first phase, worth $10 million, was done. The second depended on approval to move Candiru’s export licenses to the new company, and it was not clear whether that happened.
Calcalist’s English-language site, CTech, described the restructuring on X as a way to get around the sanctions.
Blacklisted spyware firm Candiru acquired by Integrity Partners in $30 million deal.
Integrity Partners restructures the controversial cyber firm into a new entity to bypass U.S. sanctions, as Candiru grapples with declining operations.
Recorded Future’s Insikt Group identified the new company as Integrity Labs Ltd., set up in December 2024 in Herzliya, Israel, and directed by Naftali Yoran, and found Candiru infrastructure still active in Hungary and Saudi Arabia, The Record reported. The attacks on Al Jazeera ran through 2024 and 2025, before and after the sale.
A warning since 2017
In October 2017, three University of Washington computer scientists, Paul Vines, Franziska Roesner and Tadayoshi Kohno, showed that $1,000 of ad buying was enough to track a person’s location to within eight meters, with no click required. They aimed ads at test phones by their mobile advertising IDs and suggested that ad networks refuse purchases targeting only a handful of devices.
Mr. Vines, the lead author, described the kind of buyer he had in mind in a university news release.
Anyone from a foreign intelligence agent to a jealous spouse can pretty easily sign up with a large internet advertising company and on a fairly modest budget use these ecosystems to track another individual’s behavior.
The government drew its own conclusions. The N.S.A. issued guidance in 2018 urging its staff to block “unnecessary advertising web content,” and in January 2021 the Cybersecurity and Infrastructure Security Agency told federal agencies to deploy ad-blocking software, warning that tailored malicious ads could be used against a specific victim. Senator Ron Wyden, Democrat of Oregon, pressed the White House budget office that year to require it.
Candiru came into public view in July 2021, when Microsoft and Citizen Lab tied it to Windows spyware that had infected at least 100 people, including politicians, human rights activists, journalists and dissidents, about half of them in the Palestinian territories, The Register reported.
A year later, researchers at Avast found Candiru using a Chrome zero-day against journalists in Lebanon. The delivery then was a hacked website used by a news agency’s employees. No ad was involved.
Ads entered the record in September 2023, when Haaretz reported that another Israeli firm, Insanet, had built a product called Sherlock that infected devices through online ads and had teamed up with Candiru to sell it, at a reported 6 million euros per infection, The Register wrote. That November the Irish Council for Civil Liberties published Europe’s Hidden Security Crisis, by Johnny Ryan and Mr. Christl, which argued that real-time bidding sent data about European military personnel and political leaders to foreign states and other actors.
Mr. Christl, who joined Citizen Lab as a research fellow in 2025, summed up that report on X when it came out.
Most digital advertising involves uncontrolled data sharing about everyone, including policymakers, judges, military personnel. Many companies access the data; so can foreign state and malicious actors.
New report on how RTB is a national security threat:
Intellexa’s version came next. Haaretz reported on its ad-based tool, Aladdin, in 2024, and in December 2025 Amnesty International’s Security Lab described it from leaked company material, which promised that
simply viewing the advertisement is enough to trigger the infection on the target’s device
Amnesty said it believed Aladdin had been supported in active deployments in 2024, but it reported no confirmed infection. Mr. Marczak told TechCrunch that there had long been talk of ads being used to hack chosen targets, “but now for the first time, we have concrete technical evidence showing this process in action.”
The case against
The sharpest objections on Hacker News were technical. Another commenter there asked what the ads actually added.
That objection is partly right. The exploit needs a flaw in the browser or operating system, and Candiru reached Lebanese journalists in 2022 without any ad. What the ad system added was reach by identifier. A customer entered a device’s advertising ID or IP address into Controlium, and Discover-Tech bid to put an ad in front of that device on whatever site or app its owner opened. No one had to break into a site the target visited or lure the target anywhere. Mr. Dickson said that “the ad is only the delivery truck; the exploit still needs a flaw.”
A second objection is that the vendor lists were never meant as security vetting. The record bears that out. Google’s form and IAB Europe’s statement both describe privacy compliance, and the Belgian court confined IAB Europe’s responsibility to the consent strings. The record also supports Citizen Lab’s charge. The listings let Discover-Tech’s pixel collect European consent signals and sync identifiers with major exchanges for six years, and none of the published requirements asked what the company did with that access.
The reach figures need the same care. The NATO and Pentagon findings rest on ad impressions matched to network address blocks, and Confiant wrote that “an ASN identifies an organization’s network, not a person.” The Al Jazeera finding rests on the broadcaster’s own logs and a recovered file. The two are different grades of evidence, and both research groups said so.
The first fix many readers offered was a browser ad blocker. But 76.7 percent of Discover-Tech’s bids were for in-app space that browser extensions do not reach. Computerworld reported that the Citizen Lab report says blocking advertising identifiers alone would have stopped the method. The lab told users to reset the advertising ID on their phones and to block ads across home and office networks.
What comes next
Citizen Lab asked regulators to investigate whether Discover-Tech and Candiru broke the law and urged organizations to block ads at the network level. “Digital advertising is broken,” Mr. Christl, a senior researcher at the lab, told The Globe and Mail, adding that regulators and lawmakers “must urgently step in here.”
Al Jazeera said it “strongly condemns the targeting of our staff with mercenary spyware” and called for “a full, independent investigation to identify those responsible and hold them to account.” The Committee to Protect Journalists asked Israeli and other authorities to investigate.
Discover-Tech’s suspension from IAB Europe’s list lasts until it fixes the violations and the group verifies compliance. The statement left room for more.
Further confirmation of the findings published today could also justify a definitive expulsion from the GVL.
Vungle’s review is still open. Mr. Marczak called Discover-Tech “surely just the tip of the iceberg,” and Citizen Lab said a separate report on Dark Cartographer is still to come.