Toronto: An advertisement appearing on a webpage can look routine. For staff at Al Jazeera, researchers say, targeted advertising became a route for spyware to reach their devices without anyone clicking a link.
An investigation published on October 15 by the University of Toronto’s Citizen Lab linked attacks on at least 45 devices within the broadcaster during 2024 and 2025 to spyware from Israeli company Candiru, now operating as Integrity Labs. Israeli advertising company Discover Tech facilitated delivery, the researchers said. They named the technique “AdFection”.
The distinction matters: this is an investigation into advertising technology and commercial spyware. It does not establish that artificial intelligence powered the attacks. Nor did it identify the government or specific customer responsible for ordering the operation against Al Jazeera.
The mechanism exploits what happens behind an advertisement. Online ads can contain executable code alongside images, and advertisers can use identifiers to reach particular users.
Researchers found that displaying a selected advertisement could initiate a chain leading to spyware infection. This is described as a “zero click” attack because the target need not interact with the ad.
A parallel investigation by advertising security company Confiant uncovered sophisticated device profiling and concealed communications infrastructure.
It also documented “cookie matching”, a process that connects advertising identifiers across services, allowing users to be recognised beyond a single website.
Confiant estimated that Discover Tech served around 10 million advertisements daily. Its observations showed a particularly substantial presence in Palestine, including approximately one in every 36 Android advertisements in its dataset during the period studied.
That reach does not mean every person exposed was infected: surveillance through profiling and targeted spyware delivery are distinct activities.
For journalism, the implications extend beyond individual devices. Covert access can threaten confidential reporting and the people who communicate with newsrooms.
The Committee to Protect Journalists demanded investigations and accountability. It also cautioned that advertisements appearing on other media and government networks did not, by themselves, prove spyware infection.
Al Jazeera condemned the targeting and called for those responsible to be held accountable.
Google said it removed Discover Tech from its advertising platforms for policy violations. IAB Europe suspended the company, while Comcast’s Beeswax also removed its access. Discover Tech and Candiru did not respond to Reuters’ requests for comment.
Confiant warned that cutting off one company did not resolve the weaknesses that enabled the operation. The investigation leaves a wider question for the advertising industry: how to prevent systems built to identify potential customers from becoming tools for identifying surveillance targets.
