Targeted Ads Delivered Candiru Spyware to Al Jazeera, Citizen Lab Says, but Neither Report Describes the Exploit

Citizen Lab reported on Thursday, October 15 that targeted online ads infected devices at Al Jazeera with spyware from Candiru, which now operates as Integrity Labs, and that at least 45 devices at the broadcaster were targeted in 2024 and 2025. The researchers call the technique AdFection and describe their report as the “first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads.” The ads were bought by Discover-Tech, an Israeli company that presents itself as an advertising vendor and that, Citizen Lab says, works as a facilitator for several spyware firms. Google and IAB Europe, which had listed the company as a certified or approved vendor since 2020, removed or suspended it in early October after the researchers disclosed their findings.

The reports leave a gap that matters for defenders. Confiant, an ad-security firm that published a companion analysis the same day, says it has “not captured a full exploit chain in the wild,” and Citizen Lab’s report neither describes the exploit that did the infecting nor names a vulnerability behind the Al Jazeera infections. So the reports give defenders no specific vulnerability to patch against. What the researchers do have is network logs from Al Jazeera, a malware sample from one compromised device and a detailed view of the vendor’s infrastructure, which together are enough for Citizen Lab to attribute the infections to Candiru with “high confidence.”

What Citizen Lab found

Discover-Tech runs an ad-buying platform called MyDSP and also buys ads through Beeswax, which Comcast’s FreeWheel owns, and through Eskimi. Many of its ads carry a script tag that calls back to what the company names a NOAS server. The ad reports the viewer’s cookie ID or mobile advertising ID, and the server decides, apparently from that identifier and the IP address, whether the viewer is eligible to receive code. Most viewers are not and get an empty response. Citizen Lab says that design lets Discover-Tech avoid “directly sharing malicious code, or even pointers to malicious code, with the companies who serve and display the ads.”

A second Discover-Tech platform, Controlium, works as the control panel. According to Citizen Lab, customers choose whom to profile or infect by mobile advertising ID (iOS or Android), browser ID or IP address. Discover-Tech published the front-end source code on the login page, which let the researchers rebuild the interface and read its screens.

The Al Jazeera case rests on network logs that the broadcaster shared with Citizen Lab, and Al Jazeera agreed to be named in the report. Citizen Lab says infected devices first contacted Discover-Tech domains, which it reads as an ad impression, then connected to a Candiru validator server that checks the device before it is profiled and infected, and finally contacted a Candiru command-and-control server. Al Jazeera also isolated a Windows DLL from one compromised device. The sample hard-codes two command servers that match Citizen Lab’s fingerprint, persists through a COM hijack, hides strings with a 48-byte repeating XOR key and checks connectivity against google.com and microsoft.com, the same traits as the Candiru chain the lab captured in 2021. Citizen Lab calls the sample a newer version of that chain. WIRED reports that Al Jazeera did not respond to its request for comment.

Discover-Tech also hands each target’s details to the attacker in encrypted form. In Candiru infection links from 2024 and 2025, a short query parameter decrypted every time with a key published on an “Ad URL OpSec Decoder” page on a Discover-Tech-linked website. Citizen Lab reads this as a secure handoff: the attacker can compare the visitor’s IP address with the one Discover-Tech encrypted, so a researcher cannot swap the link onto another device to capture an exploit. In one link posted to VirusTotal the value decrypted to an IP address registered to the Saudi Ministry of Foreign Affairs, which the report takes as an indication of a potential target.

How big it was

Citizen Lab found two world-readable Apache Druid databases on a Discover-Tech domain that exposed MyDSP bidding records until Discover-Tech appeared to shut them down in August. From March to June 2026, MyDSP bid on 3,770,286,576 impressions and appeared to win 441,954,291, or 11.7 percent. Yandex carried 67.4 percent of the bids, Google Ad Manager 24.74 percent and Vungle 7.24 percent. The ads ran in more than 70,000 mobile apps and more than 120,000 websites. The records list three advertisers, most of them Discover-Tech or entities linked to it, and the conversion fields are always zero, which the report calls highly unusual for an ad vendor while allowing that the records might not track conversions. The records put spend at about $109,091 if, as the report assumes, cost is stored in micros of US dollars. By our arithmetic that is roughly 25 cents for every thousand impressions won.

Citizen Lab says the ads also “covertly directed millions of devices to contact Candiru’s servers, likely for large-scale tracking and reconnaissance.” It estimates that between hundreds of thousands and millions of users were sent to Candiru-linked domains during 2025, and it counted 3,637,213 “eligible users” on a Discover-Tech server from January to June 2026, while cautioning that other Discover-Tech customers may use the same feature. The Register notes that those connections do not necessarily indicate spyware infections.

The same data show Discover-Tech ads reaching devices on the networks of defense ministries, armed forces, national cyber agencies, NATO, the United Nations and EU institutions, among others. The report says an impression “does not in and of itself confirm targeting or infection,” but that “at minimum” these impressions “would have resulted in profiling by Discover-Tech.” The Register summarizes the finding as researchers having “found no evidence that those organizations were infected.” The report’s wording is more open: it says the data “warrants urgent investigation to determine whether any users on these networks were infected with spyware,” and it notes that its view covers only MyDSP data, not Beeswax or Eskimi.

What the evidence shows and what stays open

How the ads got past ad verification

Eskimi, one of the platforms Discover-Tech bought ads through, told Citizen Lab that the advertiser’s tags “were built to evade automated scanning. They loaded different code depending on who was viewing the ad, including the device, IP address and location, and campaigns were often restricted to very narrow IP target lists. This is how they passed third-party verification.” Eskimi says Discover-Tech had been a self-service advertiser on its platform since 2022, spent only a few hundred dollars, and had its last campaign stopped on August 6, 2026.

Confiant traced the same behavior from the other end. Its scanner flagged a Discover-Tech ad on April 12, 2026, and its analysis covers April 1 to September 10. The ad’s script hands off to an obfuscated JavaScript SDK of about 90 KB that fingerprints the device, watches mouse, touch and keyboard behavior, sets up an encrypted channel to a command server and polls it once a second. The operator can push code that the SDK runs with a new Function call, in the ad frame. Confiant calls that “an effective mechanism for the surgical delivery of high-impact payloads such as browser exploits,” then states the limit: “Even though we have not captured a full exploit chain in the wild, the surrounding staging demonstrates an advanced capabilities package built to evaluate targets before delivering high-impact payloads.” A second payload carries a Google copyright comment that Confiant calls a decoy, a trick ESET documented in Candiru JavaScript in 2021.

Confiant also describes a separate harvest. In ad sessions across more than 1,000 publisher domains, Discover-Tech creatives sent the page’s first-party cookies back to the operator, and in many cases they included session IDs of logged-in users and, sometimes, emails and full names inside JWT tokens. Confiant says it saw this even where Discover-Tech lacked GDPR consent. By its description the siphon works only when the ad runs in the publisher’s own origin, either in a friendly iframe or written into the page, and only for cookies not marked HttpOnly. In a cross-origin SafeFrame it returns little or nothing. That points publishers to two controls, our reading rather than Confiant’s advice: mark session cookies HttpOnly and prefer cross-origin ad frames.

Confiant’s telemetry also shows the vendor’s ads concentrated unevenly. It counted Discover-Tech serving 1.9 percent of all ads in Palestine during the period, peaking at 9.9 percent on April 7, including 1 in 36 Android ads there, and 1 in 54 iOS ad impressions in the Netherlands. Confiant says the data broadly supports deliberate targeting by device type and operating system.

Who vouched for the vendor

Citizen Lab’s Table 9 shows Discover-Tech in IAB Europe’s Transparency and Consent Framework Global Vendor List as vendor 778 from July 2, 2020, and in several Google lists that also start in 2020, among them roughly 2,400 certified external vendors for Ad Manager. Google says certified vendors “undergo a business review,” and Citizen Lab notes the nature of that review is not specified. Its verdict on the regime is blunt: the industry “appears to perform no meaningful due diligence on participating vendors, instead improperly relying on self-attestation where vendors check a box on an online form.”

We checked two of the lists at about 19:10 UTC on October 15. The Global Vendor List (version 181, last updated 16:00 UTC today) still contains vendor 778, Discover-Tech ltd, but with a deletedDate of 2026-10-08T13:57:02Z. The framework’s specification says a vendor with that field “is considered deleted after this date/time and MUST NOT be established to users.” WIRED reports that IAB Europe says it suspended the company after an audit of its policies, and quotes a spokesperson saying “further confirmation of the findings regarding spyware could also justify a definitive expulsion from the GVL.” So the status is a suspension in IAB Europe’s words and a deletion flag in the file. Google’s ads personalization providers file no longer has provider 3036 or any row that names Discover-Tech, mtrtb or mydsp.

Other platforms responded to Citizen Lab over the past week. Google says it “terminated Discover-Tech’s access to its ad exchange platforms, blocking them from bidding or serving ads across our ecosystem” and added Safe Browsing warnings. Beeswax says it removed Discover-Tech from its buying platform after third-party validation, Vungle (Liftoff) paused all of its access during a review, and Eskimi blocked its accounts and domains. Adtimizer and Volasim denied involvement or knowledge. Xandr (Microsoft Advertising), Sunteng, IAB Europe and Affle did not respond to Citizen Lab within its deadline.

What defenders can do

Citizen Lab’s recommendations reduce exposure to ad code rather than fix a bug. For organizations it advises blocking ads and tracking at the gateway and on work devices, opting company-issued devices out of ad targeting (it mentions MDM as one route), preferring browsers with built-in anti-tracking and Global Privacy Control support, and watching traffic tied to ad impressions for malicious requests. People at elevated risk should seek expert help and can reset their Mobile Advertising ID. The report warns that blocking advertising identifiers stops Discover-Tech’s current methods, but that “the AdFection attack surface may be larger.” Our September post on the Pentagon’s ad-tracker ban shows a limit of the identifier advice: lawmakers asked why disabling advertising identifiers had not stopped data brokers from exposing troop locations.

The advice to block ads has a catch today. At 19:13 UTC we searched the text of EasyList, EasyPrivacy, uBlock Origin’s filters, privacy and badware lists, and Peter Lowe’s list for the domains named in the reports, and none contained a rule for them. AdGuard’s DNS filter listed two, tracker.mtrtb[.]com and myweb3id[.]io, but nothing for the ppv2, noas or infinoas hosts that Eskimi names as loaders, and the one StevenBlack hosts match, controliumbt[.]com, is a different domain from the names in the reports. We searched the lists by name and did not test them in a browser, so a generic pattern rule could still catch some requests.

DNS lookups at 19:18 UTC show which names still answer. We queried 1.1.1.1 and 8.8.8.8, looked up registry records, and connected to none of these hosts.

Resolving does not mean serving malicious code, and the reports hold fuller indicator lists. The point is narrower: the names at the center of the ad-serving chain were still live hours after the disclosure, so a DNS or gateway block is still a control you can apply.

What to watch

Citizen Lab says a second report will cover DARK CARTOGRAPHER, a separate actor using Discover-Tech infrastructure to link advertising IDs to phone numbers by exploiting vulnerabilities across mobile carriers, which it says has run since at least 2019. It will publish once disclosure to providers is complete. The lab also asks regulators to investigate Discover-Tech and Candiru and to require third-party audits and know-your-customer checks for vendors in “certified” registries. Candiru was added to the US Commerce Department’s Entity List on November 3, 2021, and the report says Israeli media reported in April 2025 that Integrity Partners had acquired its operations. For how little audit sits behind spyware vendors’ promises, see our October 1 post, where Paragon’s CEO said the company cannot see who its customers target.

Sources and method

We read the full text of Citizen Lab’s report, including its correspondence section, and Confiant’s analysis, plus the coverage in The Register and WIRED. Every figure about bids, spend and impressions comes from Citizen Lab’s analysis of the exposed Druid data, and the roughly 25 cents per thousand impressions is our division of two of its numbers. The registry checks used IAB Europe’s published vendor list and Google’s published providers file. The filter-list search covered the current text of EasyList and EasyPrivacy, the uBlock Origin lists, StevenBlack hosts, the AdGuard DNS filter and Peter Lowe’s list. The DNS answers came from two public resolvers, and the registry records from the RDAP service for .xyz. We did not contact Discover-Tech, Candiru or Integrity Labs; the statements attributed to them or their partners come from the cited reports, and Citizen Lab says Discover-Tech and Candiru did not respond to it.