--- title: "How did a plain ad put spyware on Al Jazeera devices without a click?" description: "According to Citizen Lab, ads bought by Discover-Tech asked a server whether the device was a target, and only the target got code. That is how at least 45 devices at Al Jazeera were targeted with Candiru spyware." url: https://ihsanalapsi.dev/articles/citizen-lab-adfection-candiru-ads lang: en date: 2026-10-21 updated: 2026-10-24 tags: ["App security", "Privacy"] author: Ihsan Alapsi (إحسان العبسي) --- # How did a plain ad put spyware on Al Jazeera devices without a click? On October 15, 2026, Citizen Lab at the University of Toronto published a report saying that devices inside Al Jazeera's network were infected with spyware through ads that looked normal, on websites and apps, without anyone clicking anything. If you work in a newsroom or have an ad SDK in your app, here is how the ad decides who gets the code, what the report confirmed and what is still missing, and what to do. ## What happened to Al Jazeera's devices? At least 45 devices inside Al Jazeera were targeted in 2024 and 2025 through ads bought by Discover-Tech, and Citizen Lab links these attacks "with high confidence" to Candiru's spyware. The report calls the method AdFection, and says it is the first time it has been shown technically and in public that mercenary spyware reached devices through a targeted ad. Mercenary spyware is surveillance software that a private company builds and sells to governments so they can plant it on the devices of specific people, as Citizen Lab defines it [in its letter to IAB Europe](https://citizenlab.ca/wp-content/uploads/2026/10/IAB-Europe-Right-to-Reply.pdf). Candiru is a company of this kind founded in Israel, and it now operates under the name Integrity Labs. The US Department of Commerce put it on the Entity List on November 3, 2021. Discover-Tech is an Israeli company that presents itself as a normal advertising company, and the report says it works as a bridge between mercenary spyware companies and the ad market. It started inside Al Jazeera: its technical team noticed strange patterns on some journalists' devices in 2024 and asked Citizen Lab to investigate, according to [Al Jazeera's own report](https://www.aljazeera.com/news/2026/10/15/israeli-ad-tech-firm-helped-spy-on-al-jazeera-devices). The network logs Al Jazeera handed to the researchers show the same sequence on the infected devices: 1. A connection to Discover-Tech domains, meaning the ad was shown on the device. 2. A connection to a Candiru validator server, which checks the device before going further. 3. A connection to a Candiru command and control (C&C) server, which the infected device ends up talking to. Al Jazeera isolated a Windows DLL file from one of the compromised devices, and it contained the addresses of two command servers. The researchers compared it with the Candiru sample they captured in 2021 and found the functions broadly similar. Both versions install themselves on the device with a COM hijack, each through a different DLL file. Both encrypt their strings with a 48-byte XOR key, though the key differs between the two. And both check connectivity against the same two sites in the same order (google.com, then microsoft.com). From these three signs together they concluded "with high confidence" that the file is a newer version of the same attack chain. The report is number 195 in the Citizen Lab series, written by Bill Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis and Ron Deibert. Al Jazeera condemned the attacks, called the targeting of its journalists an attack on press freedom, and demanded that those responsible be held to account. ## How can an ad plant spyware without you clicking it? The ad does not carry the malicious code itself. It carries a small script that sends your device's advertising ID and IP address to a Discover-Tech server called NOAS, and the server decides whether the device is a target: if yes, it returns JavaScript that the browser or app runs, and if not, it returns an empty response. The ad reaches you through real-time bidding, an auction that runs every time you open an app or site with an ad slot: your device sends a request with information about itself, advertisers bid, and the winner's ad lands on your screen, all in less than a second. [The Citizen Lab report](https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/) says the request can carry the device's identifiers and properties, its precise location and its IP address, and that the ad itself can carry code that runs inside the app or browser when it is shown. The advertising ID is a unique number the operating system gives your device so ads can recognize it: it is called IDFA on iOS and AAID on Android, and in the browser an identifier stored in a cookie takes its place. This is how the attack works, according to the report: 1. Discover-Tech wins the auction, and its ad appears on a site or app open on your device. Sometimes the ad loads in the background and you never see it. 2. The script inside the ad contacts the NOAS server and sends it the advertising ID, a cookie or the mobile ID, along with information from the browser such as cookies and the IPv6 address. 3. The server decides based on the IP address and the ID. If the device is not a target, it returns a 0-byte response. If it is, it returns JavaScript code. 4. According to [the report's executive summary](https://citizenlab.ca/research/exposing-adfection-executive-summary/), the chosen device ends up receiving malicious JavaScript code, and that code exploits a vulnerability and infects the device. So the ad being shown can be enough on its own, and that is what a zero-click attack means: an attack that does not need the victim to click, open or do anything. The companies that deliver the ad do not see the malicious code: the Discover-Tech server returns to the target only a small piece of code that points its device to Candiru's servers, and the rest comes from there. The researchers think the server returns the code once per ID, and after that returns nothing until it is given a new task. Eskimi, an ad platform through which Discover-Tech bought ads, explained in its reply to the report why these ads got past the checks of verification companies: > "They loaded different code depending on who was viewing the ad, including the device, IP address and location" ### What is the Controlium platform? Controlium is a control panel run by Discover-Tech, where the customer picks a target by advertising ID on iOS or Android, by browser cookie ID, or by IP address, and links it to ads the platform calls "controlled ads". It has a tool that shows the ads served to a given ID or address in the last 30 minutes, and a tool for recent auction requests, and the admin sets, for each customer, which countries, sites and apps they can bid on. [The ad security company Confiant](https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming) investigated at the same time, and on April 12, 2026 it tracked an ad that added a one-pixel frame (iframe) from infrastructure attributed to Candiru. The frame loaded code that looked like a normal verification script, which asked the command server every second what to do, and ran any code the operator sent it with `new Function(...)`. Confiant says this method works for delivering a browser exploit to one specific device. ## How far did Discover-Tech's ads reach? In a sample from March to June 2026, Discover-Tech ads carrying the NOAS script appeared in 75,373 Android and iOS apps and on 120,768 websites, according to Citizen Lab. These numbers count ads that people saw, not bids alone. The numbers come from two databases belonging to MyDSP, Discover-Tech's ad buying platform, which were open for anyone on the internet to read: | Number (March to June 2026) | What it means | | --------------------------- | ----------------------------------------------------------------------------- | | 3,770,286,576 | Bids MyDSP placed on an ad impression | | 441,954,291 | Bids it won, that is 11.7% | | 718,748,885 at least | Bids for ads carrying the NOAS script, about 19% | | 161 | Countries where the IP addresses that received bids for NOAS ads were located | | 76.7% | Of the bids were in mobile apps, and the rest in the browser | Yemen was the top country by number of NOAS bids (457,283,658), though the report warns that locating a country from the IP can be wrong because of VPNs and satellite internet. The apps that showed these ads include MX Player, Viber, Truecaller, Duolingo, Yahoo Mail and WeMuslim, and the Arabic websites include almasryalyoum.com in Egypt and adngad.net in Yemen. Confiant estimates that Discover-Tech serves about 10 million ads a day. But the ads that handed the device over to Candiru's infrastructure were a tiny share, from hundreds to a few thousand impressions a day, and reached nine countries, mostly Belgium (56% of these impressions), and including Saudi Arabia, the UAE and Bahrain. Most of them were on home and mobile connections. According to Citizen Lab, a Candiru infection link posted on VirusTotal contains an encrypted IP address. The researchers decrypted it with a key that Discover-Tech itself published on a page called Ad URL OpSec Decoder, and the address turned out to be registered to the Saudi Ministry of Foreign Affairs, so they consider the ministry a possible target. Outside Al Jazeera, the bidding data shows Discover-Tech ads on government networks in 24 countries so far, including Libya, Somalia and the UAE, on the networks of NATO, the United Nations and the European Parliament, on networks of electricity and energy companies, and on networks of media organizations in at least eight countries. Citizen Lab says this exposure alone does not prove targeting or infection. But at minimum, in its assessment, Discover-Tech collected information about these devices, and in some cases the ad may have run code on them from Candiru or from other parties. ## What is still unknown? The report confirms the targeting at Al Jazeera and links it to Candiru, but it does not yet name who ordered the attack, and it is missing some details in the evidence and the numbers: - Who the customer is: the report says it is not known yet which governments exactly are using these capabilities, and according to [The Hacker News](https://thehackernews.com/2026/10/citizen-lab-traces-zero-click-candiru.html) the researchers did not say which government is behind the operation. - The first vulnerability: Al Jazeera isolated the spyware file from one device, but the report does not publish the exploit that breaks the browser or app to install it, and [Confiant says](https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming) it did not capture a full exploit chain. There is no CVE number for this attack in the report; the numbers in it are for older Candiru attacks in 2021 and 2022. - The number of infections: at least 45 devices were targeted at Al Jazeera, and the report says some devices were infected, without a number. For the government and media networks where the ads appeared, the report calls for an urgent investigation to find out whether anyone on them was infected. - The limits of the data: the numbers come only from MyDSP and cover four months, without data from Beeswax and Eskimi. - A coming report: another actor the report calls DARK CARTOGRAPHER uses Discover-Tech's infrastructure to link advertising IDs to phone numbers, and its details will come in a separate report once the notification to telecom companies is done. ## Who cut Discover-Tech off from ads? Google removed Discover-Tech from its vendor lists, and IAB Europe suspended it from its list, at the start of October 2026, before the report was published. The company had been on these "approved" lists since 2020. Both steps came as a result of the Citizen Lab investigation, and Google itself took part in it. Other ad platforms cut it off too, and each one explained in its reply to the report what it did: | Party | What it did, according to its reply | | ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Google | Cut Discover-Tech's access to ad exchanges, and turned on Safe Browsing warnings for the domains known to belong to the actor | | IAB Europe | Suspended it from the Global Vendor List (GVL) from October 8, 2026 after an audit found breaches of TCF policies, and said that confirming the spyware link could justify removing it for good | | Beeswax (FreeWheel and Comcast) | Removed it from the Buyer Cloud platform after verification by an independent security expert | | Vungle (Liftoff) | Stopped all its access during its review, and did not confirm or comment on the report's details because the review is still ongoing | | Eskimi | Closed its accounts, users and domains for good, and its last campaign there stopped on August 6, 2026 | [IAB Europe's reply](https://citizenlab.ca/wp-content/uploads/2026/10/Citizen-Lab-Right-to-Reply-IAB.pdf) shows the limits of these lists: being listed is not a certificate that the company complies with the European data protection law (GDPR), it does not require checking the connections of the people behind the company, and the organization says it is not equipped for criminal investigations. Discover-Tech, Candiru, Microsoft's Xandr and Sunteng did not reply to Citizen Lab before the deadline they were given. ## How do you lower the risk if you work in a newsroom or an organization? The most important step, according to Citizen Lab, is to block ads at the network gateway and on work devices, because right now there is no way that is always safe to expose your network to targeted ads. 1. Block ads and tracking at your organization's network gateway and on work devices. The report points out that the NSA and CISA have recommended ad blockers since 2018 and 2020. 2. Turn off ad targeting on work devices from your device management system (MDM), and write clear guidance for staff about their personal devices. 3. Delete the advertising ID on Android: open Settings, then Privacy, then Ads, and tap Delete Advertising ID. According to [Google](https://support.google.com/googleplay/android-developer/answer/6048248?hl=en), any app that tries to read it after that gets a string of zeros. 4. On iPhone: open Settings, then Privacy & Security, then Tracking, and turn off Allow Apps to Request to Track. According to [Apple](https://support.apple.com/en-us/102420), an app that asks to track while this option is off cannot get the IDFA. 5. Use a trusted ad blocker and a browser that blocks tracking, and if you can, add ad blocking on your home router too, as the report recommends. 6. Keep your browser and operating system up to date. This is general advice, not from the report, and the reason is that in 2022 Candiru used, according to Avast, which the report cites, a Chrome vulnerability called CVE-2022-2294, [exploited through a crafted HTML page](https://nvd.nist.gov/vuln/detail/cve-2022-2294) and fixed in Chrome 103.0.5060.114. Updating closes known vulnerabilities, and it does not protect against one nobody knows about yet. 7. Search your network logs for the same sequence: a Discover-Tech ad, then a validator server, then a command server. The published indicators include the ad domain, the two command servers written inside the file Al Jazeera isolated, and the hash of the file itself. The full lists are in two places: section 2 and Appendix C of the Citizen Lab report (validator and command servers and Discover-Tech domains), and the Indicators section of the Confiant report: ``` mtrtb[.]com fearevolve[.]com jobmarcher[.]com 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8 ``` And if your work makes you more of a target than others, as in newsrooms, the report advises you to bring in a specialist to review your logs instead of relying on these steps alone. ## What should a developer with an ad SDK in their app or site know? The ad slot in your app or site can run code from parties you do not know, because the auction decides who wins it, not you. And what that code can read depends on where it runs. Discover-Tech ads came through Google, Yandex, Vungle, Beeswax and others, so you do not need to have worked with Discover-Tech for its ad to show up in your app or on your site. On the web, Confiant found that Discover-Tech's code read `document.cookie` and sent it to its servers, and the result depends on where the ad was shown. In a frame from another origin, such as SafeFrame, it gets little or nothing. In a frame that shares your site's origin, or when the ad is written straight into the page, it gets every cookie that has no HttpOnly flag. Confiant saw this on more than 1,000 publisher sites, sometimes with the sessions of logged-in users in the cookies. So you have two steps: 1. Show ads in a frame from an origin other than your site, not directly inside your page. 2. Set HttpOnly on the session cookie. According to [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie), this option stops JavaScript from reaching the cookie through `document.cookie`: ``` Set-Cookie: session=; HttpOnly; Secure; SameSite=Lax ``` These two steps stop the ad script from reading your site's cookies and your visitors' sessions, but they do not stop the collection of the IP address and part of the device fingerprint, or the exploitation of a vulnerability in the visitor's own browser. And Citizen Lab says the industry's current measures, SafeFrame among them, are not enough or are not applied in practice. Your site can send Discover-Tech information about its visitors even if its ad never shows up there, through ID syncing: ad companies swap a visitor's IDs with each other so they can follow them from site to site. According to section 6 of the Citizen Lab report, many sites send background requests to two of the company's domains to sync with Yandex and Beeswax: `events.myweb3id[.]io` and `tracookiepixel[.]xyz`. These two domains receive at least the visitor's IP address and information about their browser and operating system. To find out whether your site is one of them, open a page with ads, then in the developer tools open the Network tab and search for `myweb3id`, `tracookiepixel` and `mtrtb`. The auction changes from visit to visit, so try more than one page, and if any of them shows up, ask your ad provider who added it. On Android, [Google says](https://support.google.com/googleplay/android-developer/answer/6048248?hl=en) that an SDK such as Google Mobile Ads may declare the `AD_ID` permission, and this permission gets merged into your app's manifest on its own even if you never wrote it. So your app gets permission to read the same kind of ID that Controlium used to target people. And [Google Play](https://support.google.com/googleplay/android-developer/answer/13326895?hl=en) holds you responsible for making sure the third-party code in your app follows its policies, and asks you to know what permissions it has, what it collects and why. The same applies if your app is built with Flutter or React Native: every library you add becomes part of the app. Before you add or update an ad SDK, ask its provider who it sells the slot to, and open the final manifest after the merge to see which permissions came in with it. For your own code, I am preparing the [Security Skill Pack](/products/security-skill-pack), still in the works: skills you run on your project that warn you about permission and IDOR vulnerabilities before you deploy. The pack is listed in the [AI skills](/products/c/ai-skills) section, with the other skills I build for Claude Code and other AI tools. And if your platform has user accounts and you want someone to test it the way an attacker would, that is the work of [Muhassan: penetration testing and security hardening](/muhassan). Testing the platform does not detect spyware on an employee's device; that needs a digital forensics specialist, as the report recommends. Open your app or site now: who is the last party that can run code in your ad slot, and do you know them by name? ## FAQ **Was everyone who saw a Discover-Tech ad infected with spyware?** No. Citizen Lab says the ad being shown does not prove targeting or infection on its own. The server returns code only to the chosen device. And the ad collects information about every device it shows up on, such as cookies and the IP address. **Does an ad blocker protect me from this kind of attack?** It lowers part of the risk. Citizen Lab recommends a trusted ad blocker and blocking ads across the whole network, and says that blocking the advertising ID stops Discover-Tech's current methods, but the attack surface may be wider than that. **What is the mobile advertising ID and how do I turn it off?** A unique number the operating system gives your device so ads can recognize it, called IDFA on iOS and AAID on Android. On Android you can delete it from Settings under Privacy then Ads, and on iPhone turn off Allow Apps to Request to Track under Privacy & Security then Tracking. **Is the problem limited to Al Jazeera?** No. According to the report, Discover-Tech ads have appeared on government networks in 24 countries so far, and on NATO and United Nations networks too. But the confirmed infection published is the Al Jazeera case, and an ad appearing on a network does not prove infection. **Who decides what shows up in the ad slot in my app or site?** Usually not you. Real-time bidding decides who wins the slot in less than a second, and the winning ad can carry code from the advertiser, the buying platform or other parties, and that code runs inside your app or page when the ad is shown. **How do I know if my device was infected by an ad like this?** Usually you cannot tell on your own. Citizen Lab says many infections happened with no visible sign on the device. If your work makes you a target, as in journalism, ask a specialist to review your network logs and look for this sequence: a Discover-Tech ad, then a validator server, then a command server.