Al Jazeera Staff Phones Infected via AdTech Spyware Delivery

The short version

• Journalists at Al Jazeera had their phones compromised by spyware delivered through standard online advertisements.
• The attack required no clicks or downloads, exploiting the real-time bidding system used by advertising platforms.
• Discover-Tech, an Israeli adtech company, is accused of facilitating these infections for spyware vendors like Candiru.

The details

Staff members at the news organisation Al Jazeera are among those whose mobile devices were compromised by sophisticated spyware. According to Citizen Lab, researchers traced these infections to an operation involving the Israeli adtech firm Discover-Tech. The investigation revealed that at least 45 devices associated with Al Jazeera were infected during 2024 and 2025. The spyware involved was produced by Candiru, an Israeli developer now known as Integrity Labs. These infections occurred without the users performing any suspicious actions, such as downloading files or clicking links.

The mechanism behind these attacks is described by researchers as "AdFection." This technique turns standard advertising networks into a delivery system for mercenary spyware. When a user opens a website or app, the advertising infrastructure loads. Discover-Tech allegedly exploited the real-time bidding system that determines which ads appear on screens. This system collects data about the user's device and location during the bidding process. The firm used this information to identify specific targets and serve them malicious advertisements instead of legitimate content.

Citizen Lab states that Discover-Tech appears to have acted as a front for large-scale ad espionage abuse. The researchers argue that serving as a bridge between the advertising industry and hacking vendors was the company's primary purpose. By leveraging the legitimacy of the adtech ecosystem, the operation enjoyed a level of trust typically afforded to standard digital marketing platforms. This allowed the spyware to reach targets who might otherwise have avoided suspicious downloads or phishing emails.

The context

This incident represents the first publicly confirmed case of a zero-click mercenary spyware attack being delivered through targeted online ads. Previously, such sophisticated surveillance tools often required physical proximity or social engineering tricks to install. The use of adtech infrastructure lowers the barrier for attackers, allowing them to reach high-value targets through routine digital activities. The involvement of Discover-Tech highlights how legitimate commercial technologies can be repurposed for espionage. It also raises concerns about the security of the real-time bidding systems that underpin much of the modern internet's advertising economy.

Defender's checklist

• Monitor for unexpected battery drain or data usage on mobile devices, which can indicate background spyware activity.
• Review permissions granted to apps and browsers, ensuring they do not have unnecessary access to location or identifiers.
• Keep operating systems and applications updated to patch known vulnerabilities that could be exploited in zero-click attacks.
• Use network-level filtering tools that can block known malicious advertising domains and tracking scripts.

If your data is involved

If you work in journalism or a targeted sector, treat your device as potentially compromised if you suspect exposure. Check for unusual behaviour such as rapid battery depletion or unexpected data consumption. Review your account activity for signs of unauthorised access. Be wary of follow-up scams that may reference this incident to trick you into revealing credentials. Teams usually advise rotating passwords and enabling multi-factor authentication after any suspected breach. Verify the identity of anyone contacting you about security issues through a separate, trusted channel.

Background: Phishing

Phishing is a broad, automated attack sent to thousands of recipients using generic templates. Spear phishing targets specific individuals or organisations using researched personal details. The core difference lies in the level of personalisation. You defend against phishing with technical filters and against spear phishing with verification protocols and human awareness.

Read the full guide: Phishing vs Spear Phishing: Targeting Mechanics and Defence

What to do and how to stay safe: Discover-Tech

• Update your mobile operating system and all installed applications to the latest available versions to close known security gaps.
• Enable multi-factor authentication on all critical accounts to add a layer of protection even if credentials are stolen.
• Review the permissions granted to your web browser and advertising-supported apps, restricting access to location and identifiers where possible.
• Monitor your device for unusual performance issues, such as unexpected heating or battery drain, which may indicate hidden processes.

Step-by-step guide: EDR Misconceptions: Why Endpoint Detection Fails Without Context

General security guidance from the Cipher Insider newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which spyware vendor was involved in the Al Jazeera attacks?

The spyware was produced by Candiru, an Israeli developer now known as Integrity Labs.

How did the spyware get onto the devices?

It was delivered through targeted online ads using a technique called AdFection, requiring no user clicks.

What role did Discover-Tech play?

Discover-Tech allegedly acted as a middleman, using ad bidding data to target specific individuals with malicious ads.