Israeli Ad Firm Facilitated Spyware Delivery Through Online Ads, Targeting Al Jazeera

An Israeli advertising company, DiscoverTech, has been secretly enabling the delivery of spyware through online advertisements, impacting at least 45 devices belonging to Al Jazeera, researchers at Citizen Lab and Confiant have found. The firm allegedly allowed spyware developers, including Candiru, to inject malicious software onto visitors’ devices via advertisements served on over 120,000 websites and 75,000 apps. This marks the first documented instance of online ad platforms being used as a vector for such cyberattacks, bypassing traditional methods requiring downloads or clicks. The malicious code used to target Al Jazeera was “no-click” spyware, meaning devices were infected simply by visiting a compromised website displaying the ads, with the attacks occurring in 2024 and 2025.

DiscoverTech, founded in 2020, provided access to advertising platforms run by Google, Comcast, and Yandex, according to the reports. While the company publicly promotes providing “fraud-free traffic,” it operated a separate program facilitating the spyware delivery. Google, IAB Europe, and Comcast have since severed ties with DiscoverTech due to policy breaches. Researchers estimate that hundreds of millions of people may have been exposed to DiscoverTech’s ads, with at least 10 million served daily.

Al Jazeera provided network logs to Citizen Lab, aiding in the reconstruction of the attacks. This follows a previous report detailing the hacking of 36 Al Jazeera journalists and staff with Pegasus spyware, allegedly by actors linked to Saudi Arabia and the United Arab Emirates. The US Commerce Department blacklisted Candiru in 2021 for supplying spyware used in malicious targeting. Attempts to reach DiscoverTech and Candiru for comment were unsuccessful. Natalia Krapiva, a spyware expert at Access Now, stated, “Any time we browse the internet or open an app, all the data on our device can be hacked by malicious actors without us even knowing,” and called for urgent action from states and tech companies.

Where they differ

• The Straits Times emphasized the scale of DiscoverTech’s reach, noting its ads appeared on over 120,000 websites and 75,000 apps, a detail less prominently featured in the NBC News report.
• NBC News included a quote from a spyware expert at Access Now, providing additional context on the broader implications of the findings, while The Straits Times focused more on the technical aspects of the operation.
• The Straits Times explicitly stated the case raises wider fears that ad tech is a national security threat, a framing not directly present in the NBC News article.

What is not yet known

• The full extent of the damage caused by the spyware on Al Jazeera’s devices remains unclear.
• The motivations behind the targeting of Al Jazeera specifically are not detailed in the reports.

Was this useful? 👍 0 👎 0

---

Read the original coverage