Investigations tie Israeli ad-tech firm to zero-click spyware delivered via online ads, targeting Al Jazeera and wider audiences
Narrative Snapshot
Across geographically and politically diverse outlets, coverage centers on two technical investigations that attribute a novel, “zero-click” ad-based intrusion method to the Israeli ad-tech firm Discover-Tech and link it to the mercenary spyware vendor Candiru. Al Jazeera English details the technique and frames the risk as systemic to global advertising infrastructure, while Le Monde emphasizes how a company positioned in the ad market is selling services into the surveillance sector. Israeli outlets, including Haaretz and The Times of Israel, underscore the reported reach of the ad placements and Candiru’s U.S.-blacklisted status.
Estimates of impact diverge. Middle East Eye cites Citizen Lab in calling this the first publicly confirmed case of zero-click mercenary spyware delivered through ads and reports “millions” infected and “hundreds of millions” targeted, whereas Al Jazeera English and Haaretz foreground verified compromises within Al Jazeera and the breadth of the ad distribution network. Tehran Times stresses alleged multi-year failures by major ad platforms to block the technique; RT, drawing on Confiant’s findings, highlights the campaign’s anti-interception measures and micro-targeting.
What is most at stake in the reporting is the weaponization of ubiquitous adtech rails to identify, track, and compromise targets without interaction, including journalists. Haaretz adds that Palestinian sites were among those affected, and multiple outlets report that Discover-Tech’s infrastructure funneled devices toward Candiru-controlled systems. The Palestinian outlet Al-Quds News, citing the Financial Times, reinforces that Al Jazeera staff devices were a focus, reflecting regional concern over newsrooms’ exposure.
What Happened
Two reports published on 15 October 2026 by Citizen Lab and ad security firm Confiant describe an Israeli ad-tech company, Discover-Tech, using online advertising to stage zero-click spyware operations. Al Jazeera English reports that dozens of Al Jazeera devices were infected after “adfection” placements required no user interaction. Middle East Eye, citing Citizen Lab, says at least 45 devices within Al Jazeera were targeted in 2024 and 2025, and characterizes this as the first publicly confirmed case of zero-click mercenary spyware delivered via ads. Haaretz reports Citizen Lab’s finding that Discover-Tech’s ads reached over 120,000 websites and 75,000 apps and connected to Israeli spyware and surveillance firms, including U.S.-blacklisted Candiru. The Times of Israel adds that Discover-Tech could identify users even without clicks. RT quotes Confiant describing “weaponization” of ad infrastructure with robust anti-interception and surgical micro-targeting. Tehran Times alleges major ad platforms failed to stop the technique for at least two years.
Why It Matters
Using mainstream ad infrastructure as a delivery mechanism converts routine web and app activity into a scalable surveillance vector. Haaretz’s reporting on reach across more than 120,000 websites and 75,000 apps illustrates how an advertising supply chain can be repurposed to identify, track, and compromise devices without interaction, as emphasized by The Times of Israel and Al Jazeera English. The reported involvement of Candiru, a firm already blacklisted by the United States, suggests that existing punitive measures against mercenary spyware actors may not disrupt their integration into adjacent commercial ecosystems. Tehran Times’ account of multi-year failures by global ad platforms to interdict the method spotlights gaps in private-sector controls over programmatic ad placements. Coverage by Al Jazeera English and Haaretz that journalists and Palestinian sites were among the targets connects the case to press freedom and civil society risk, elevating it to a cross-border governance and platform-security problem.
Diverging Narratives
The most prominent divergence concerns scale. Middle East Eye reports that “millions” were infected and “hundreds of millions” targeted, while Al Jazeera English and Haaretz focus on confirmed compromises within Al Jazeera and the technical reach of the ad network. That difference leaves uncertainty about how many devices moved from reconnaissance to confirmed infection beyond the newsroom cases. On scope, Haaretz adds that Palestinian sites were in the targeting set, whereas several outlets concentrate on Al Jazeera as the primary example.
Framing also varies. RT characterizes the operation as global and cites Confiant’s language about “weaponization” and micro-targeting. Le Monde situates Discover-Tech as an ad company selling into the surveillance sector, highlighting industry crossover rather than campaign theatrics. Tehran Times emphasizes that ad-platform companies did not stop the campaign for at least two years, assigning responsibility to platform governance. Al Jazeera English introduces “adfection” to describe the technique and stresses its zero-click nature and systemic risk. Finally, attributions are consistent on Discover-Tech and Candiru, but Al-Quds News relays the story through Financial Times reporting, reflecting reliance on secondary sourcing in parts of the region.
What Happens Next
Key decision points lie with the digital advertising intermediaries and with governments that already sanction mercenary spyware vendors. Tehran Times’ claim that major ad platforms failed to halt the technique for years makes their remediation steps an immediate indicator; analysts should watch for changes to ad-vetting pipelines, traffic filtering, and public transparency about suspected abuse. Given that multiple outlets note Candiru’s U.S.-blacklisted status, further regulatory or enforcement actions aimed at firms integrated into the ad supply chain, not only end-stage spyware vendors, would signal a policy shift.
On the investigative front, Haaretz’s reporting on the breadth of affected websites and apps and Middle East Eye’s account of targeted Al Jazeera devices suggest additional technical disclosures are possible; updates from Citizen Lab or Confiant would clarify infection counts versus exposure. Finally, whether Discover-Tech or implicated partners issue substantive responses will shape both accountability and the feasibility of technical mitigations across ad ecosystems.