Candiru, an Israeli spyware company, is at the center of controversy after researchers from the Citizen Lab revealed that it infiltrated devices at Al Jazeera using online advertisements. This sophisticated attack required no user interaction, triggering as soon as an ad was displayed on the screen. The Citizen Lab, affiliated with the University of Toronto, highlighted this as the first technical confirmation of mercenary spyware reaching devices via targeted ads.
How the Spyware Infiltrated Devices
The attack involved Discover-Tech, an Israeli firm that masqueraded as a legitimate digital advertising company. The ads contained code that transmitted the device’s advertising ID and IP address to a Discover-Tech server. If the server identified the device as a target, it sent back malicious code for the app or browser to execute. This tactic allowed the ads to appear harmless, preventing detection by ad networks.
At least 45 devices at Al Jazeera were targeted in 2024 and 2025. The attack process involved initial contact with a Discover-Tech server, followed by communication with a Candiru server, and finally, a command-and-control server that managed the spyware. The Citizen Lab confirmed the involvement of Candiru through technical analysis, although the responsible government entity remains unidentified.
Response from Platforms and Companies
Following the revelations, Google and IAB Europe removed Discover-Tech from their approved vendor lists. Google also restricted Discover-Tech’s access to its ad exchanges, while other platforms like Beeswax and Vungle took similar actions. These moves came after policy violations were discovered during audits. However, Discover-Tech, along with Candiru’s owners and Al Jazeera, did not respond to requests for comments.
Wider Reach and Implications
The reach of Discover-Tech’s ads extended beyond Al Jazeera, reaching various governmental and institutional networks globally. According to Confiant, a U.S. ad-security firm, Discover-Tech’s ads appeared in numerous apps and websites, with potential exposure to sensitive networks like NATO and the United Nations. Despite their widespread presence, the ads primarily impacted home and mobile internet users.
Security experts have long warned about the vulnerabilities within ad-buying systems that could be exploited for such attacks. Indicators of the attack, including specific web addresses and files, have been published to aid organizations in identifying and mitigating the threat.
This incident underscores the necessity for robust cybersecurity measures and vigilance in monitoring digital advertising channels. As spyware tactics evolve, it is crucial for organizations to remain proactive in safeguarding their networks against such sophisticated threats.
