Israeli Ad-Tech Firm Discover-Tech Linked to Zero-Click Spyware Attacks on Journalists
An investigation by the University of Toronto's Citizen Lab has identified that the Israeli advertising technology company Discover-Tech facilitated the deployment of spyware on devices used by Al Jazeera journalists. The attack utilized a zero-click method, where spyware from the blacklisted firm Candiru was embedded within advertisements. Once these ads appeared on a device, the system was compromised, allowing for the unauthorized collection of data. Al Jazeera's internal security team first detected suspicious activity in 2024, with the pattern persisting into 2025. Additionally, the security firm Confiant reported that Discover-Tech advertisements have appeared in critical networks associated with the Pentagon, the International Atomic Energy Agency, and the International Criminal Court.
Key points
- Citizen Lab confirmed Discover-Tech used targeted ads to deliver Candiru spyware.
- The attack method is described as the first-known instance of zero-click targeted advertising.
- Al Jazeera journalists reporting on sensitive subjects were among those targeted.
- Confiant reported Discover-Tech ads appeared in networks used by the Pentagon and international organizations.
- Candiru was blacklisted by the U.S. government in 2021 for malicious cyber activities.
What Happened
The Israeli advertising technology firm Discover-Tech has been implicated in a spyware campaign targeting Al Jazeera journalists. According to a report from the University of Toronto-based Citizen Lab, Discover-Tech purchased advertisements containing malicious code from Candiru, a company previously blacklisted by the United States government.
The campaign employed a zero-click mechanism, meaning devices were infected simply by the appearance of the advertisement. This allowed the spyware to exfiltrate data from the affected platforms without user interaction.
What Changed
Al Jazeera's internal technology team identified unusual patterns on journalist devices beginning in 2024, which continued into 2025. Following an internal probe, the network engaged Citizen Lab to conduct a formal investigation, which verified the attacks through an analysis of network logs.
Beyond the impact on Al Jazeera, the security firm Confiant reported that Discover-Tech advertisements have been observed within critical networks belonging to the Pentagon, the International Atomic Energy Agency, and the International Criminal Court.
Why it matters
The use of zero-click advertising to deploy spyware represents a significant escalation in digital surveillance threats against journalists and critical institutions. It remains unclear how many devices beyond those at Al Jazeera were compromised through these advertisements.
What we know
- Citizen Lab reported that Discover-Tech purchased advertisements containing Candiru spyware.
- The spyware deployment utilized a zero-click method via targeted advertising.
- Al Jazeera confirmed its journalists were targeted by spyware.
- Candiru was blacklisted by the U.S. government in 2021.
- Confiant reported that Discover-Tech advertisements appeared in networks used by the Pentagon, the International Atomic Energy Agency, and the International Criminal Court.
What remains unclear
- The full extent of the compromise within the Pentagon, IAEA, and ICC networks remains unverified by independent sources.
- The specific identity of the entities behind the purchase of the spyware from Discover-Tech is not publicly confirmed.
