Gaza Herald – The Citizen Lab has identified a new method of digital surveillance where Israeli mercenary spyware named Candiru was distributed to millions of devices via zero-click advertisements. This investigation marks the first public confirmation of such spyware being delivered through targeted ads.
The Canadian watchdog group published its findings on Thursday, detailing how the malware operated without requiring user interaction. The report highlights that this technique represents a significant escalation in cyber espionage capabilities.
Discover-Tech, an Israeli firm presenting itself as a legitimate advertising entity, facilitated these attacks. According to the report, the company worked with partners like Candiru to place ads that directed devices in dozens of countries to contact malicious servers for tracking and reconnaissance.
The Citizen Lab discovered that between 2024 and 2025, at least 45 devices linked to Al Jazeera Media Network were targeted. These targets were hit through a series of zero-click ad attacks purchased by Discover-Tech.
The operation utilized a platform called Controlium. This system allowed mercenary partners to de-anonymize users, fingerprint their devices, and automatically infect them the moment the advertisement appeared on screen.
No click or download was necessary for the infection to occur. The spyware activated immediately upon the ad being displayed, bypassing traditional security measures that rely on user consent or action.
The scope of the campaign affected millions of people globally. The use of digital advertisements as a vector for malware distribution complicates detection efforts, as the traffic appears similar to normal web browsing activity.
Al Jazeera devices were specifically singled out in this campaign. The targeting suggests a strategic interest in monitoring media operations and potentially intercepting communications within the network.
Discover-Tech’s role in this infrastructure underscores the commercialization of surveillance tools. By operating under the guise of an ad tech company, the firm could mask its involvement in espionage activities from regulatory scrutiny.
The Citizen Lab’s analysis provides technical evidence of how zero-click exploits are integrated into everyday internet usage. This method allows attackers to reach a broad audience while maintaining plausible deniability about the nature of the data collection.
The report emphasizes the vulnerability of mobile and desktop devices to such sophisticated attacks. Users remain unaware that their devices have been compromised simply by visiting websites containing the malicious ads.
This incident highlights the growing intersection between digital advertising and national security threats. The ability to infect devices remotely through standard web technologies poses a significant risk to privacy and information security worldwide.
This report was produced in the Gaza Herald newsroom.
