AI News Feed
Market watch
South Korea Finance Minister Says Chip Boom to Last at Least Through 2027Aion Opens Ray7 Coupe Pre-Sales From 128,800 YuanSamsung Auto Blocker Shields Galaxy Phones From Risky Apps, but Sideloading Gets HarderResearchers say ad-served zero-click spyware infected at least 45 Al Jazeera devicesAnbernic prices RG DDS at $299.99, nearly double the original 3DSGoogle Maps Street View blurs some locations permanently, Engadget reports
South Korea Finance Minister Says Chip Boom to Last at Least Through 2027Aion Opens Ray7 Coupe Pre-Sales From 128,800 YuanSamsung Auto Blocker Shields Galaxy Phones From Risky Apps, but Sideloading Gets HarderResearchers say ad-served zero-click spyware infected at least 45 Al Jazeera devicesAnbernic prices RG DDS at $299.99, nearly double the original 3DSGoogle Maps Street View blurs some locations permanently, Engadget reports
Cybersecurity

Researchers say ad-served zero-click spyware infected at least 45 Al Jazeera devices

Ad-delivered zero-click spyware infected at least 45 Al Jazeera devices, researchers say, linking the campaign to Candiru and ad-tech firm Discover-Tech.

AI News Feed · 2026-10-18 02:10

The infection required no click and no visible sign of interest. According to the published research, a device was compromised the moment an advertisement was served on a page the user was browsing. The infostealer harvested files, documents, cookies, bookmarks and saved credentials, logged keystrokes, took screenshots during working hours, and could activate the microphone and camera to record the user. Email and instant messages across a range of platforms were also collected and sent out of the device.

Some Al Jazeera journalists noticed their devices behaving unusually in 2024 and approached Citizen Lab, which traced the infection chain and confirmed the delivery method.

Citizen Lab attributed the infostealer and the mechanism that delivered it to Candiru, an Israeli mercenary spyware vendor that has since rebranded as Integrity Labs following a reported acquisition. The US Department of Commerce blacklisted Candiru in early November 2021, citing evidence that it supplied spyware to foreign governments which used it against government officials, journalists and activists. The company was delisted in late July 2026. Researchers said the tool cost "several million dollars" but did not identify who bought it or which party carried out the surveillance.

The advertisements themselves were served through infrastructure run by Discover-Tech, an Israeli ad-tech company that operates MyDSP, a demand-side platform buying digital advertising inventory through automated ad exchanges. "We present technical evidence that the Israel-based company Discover-Tech, while purporting to be a legitimate advertising company, appears to be a front for large-scale ad espionage abuse," Citizen Lab researchers wrote, adding that serving as this bridge appeared to be the company's primary purpose.

The Register reported that Discover-Tech has been listed with Google and IAB Europe as an approved vendor since 2020. Citizen Lab analysed roughly four billion ad-bidding records and found Discover-Tech advertisements on more than 70,000 mobile apps and 120,000 websites in the second quarter of 2026 alone.

The same outlet, citing data from New York-based advertising security firm Confiant, reported that some Discover-Tech ads also appeared on critical networks used by the Pentagon, the United Nations International Atomic Energy Agency and the International Criminal Court, which in 2024 issued an arrest warrant against Israeli Prime Minister Benjamin Netanyahu alleging responsibility for war crimes and crimes against humanity.

Citizen Lab said at least 45 Al Jazeera devices were compromised through this route in 2024 and 2025. How many other people were affected, and where they work, has not been established.