Israeli companies allegedly used online advertisements to deliver spyware to devices belonging to journalists and staff at Qatar-based broadcaster Al Jazeera, according to cybersecurity researchers. The findings highlight how digital advertisements, normally used to promote products and services, can also become a channel for surveillance and cyberattacks.
This was revealed in a report by the University of Toronto's Citizen Lab and the ad security company Confiant. This group has been tied to a spyware company named Candiru and an Israeli advertising agency known as Discover-Tech.
Citizen Lab said spyware delivered through Discover-Tech's advertising network compromised 45 Windows devices at Al Jazeera between 2024 and 2025. Researchers said they confirmed the findings after the broadcaster shared its network logs with them.
The spyware was linked to Candiru, an Israeli surveillance company blocked by the US government in 2021 over allegations that its tools were used to target government officials, journalists, activists and academics.
Al Jazeera did not respond to requests for comment, Reuters said. Discover-Tech and Candiru also did not respond to requests for comment.
According to the researchers, Discover-Tech's ads appeared on more than 120,000 websites and in 75,000 applications through its advertising partnerships. The company reportedly distributed at least 10 million advertisements daily.
The advertisements often promoted ordinary consumer products, including phones and earphones. Researchers said the ads could track users and, in some cases, attempt to extract phone numbers from smartphones. The surveillance could occur when an advertisement loaded, without requiring the user to click on it.
The reports described the technique as a form of zero-click spyware delivery, raising concerns about how advertising technology can be exploited to target individuals without their knowledge.
Also Read: South Korea Finds Hacking Incidents at 16 Financial Firms, Data Leaks
The investigation also raised questions about major advertising platforms' role. Discover-Tech reportedly accessed advertising networks operated by companies including Google, Comcast and Russia's Yandex.
As a result, Reuters says Google, Comcast's Beeswax, and IAB Europe denied Discover-Tech access to their systems.
Experts have said the campaign exposed how online advertising architecture can be used for surveillance. These findings also showed how difficult it is to protect people when malicious ads can be served through seemingly legitimate websites and apps.
This is one example among others of commercial spyware and the targeting of journalists, government officials, and others who need secrecy in communication.