Citizen Lab links Candiru zero-click spyware infections at Al Jazeera to malicious ads served via Discover-Tech
Citizen Lab reported that Israeli mercenary spyware vendor Candiru infected devices at Al Jazeera through targeted online ads that needed no user interaction. It calls this the first public technical confirmation of mercenary spyware reaching real devices via ad delivery. At least 45 Al Jazeera devices were targeted in 2024 and 2025, and Citizen Lab attributes the activity to Candiru with high confidence. It did not name the government customer behind the operation. The ads were placed by Discover-Tech, an Israeli firm posing as a legitimate ad company. Google, IAB Europe and several ad platforms removed it in early October 2026 after being notified.
Technical Details
- Each ad carried a small callback script that sent the device's advertising ID and IP address to a Discover-Tech server. The script ran as soon as the ad loaded, sometimes in the background.
- That server decided whether the device was a target. For targets it returned attack code to the browser or app; for non-targets it returned nothing. Because the ads carried no malicious code, ad networks had nothing to detect.
- Al Jazeera traffic logs showed a consistent sequence on infected devices: a Discover-Tech ad server, then a Candiru screening server, then a command-and-control server running the spyware.
- Researchers recovered the spyware from one device but not the browser or app exploit. The initial compromise step is inferred from how the attack was set up, not from captured code.
- A Windows program file pulled from a compromised device shares distinctive techniques with a Candiru tool Citizen Lab analyzed in 2021, which underpins the high-confidence attribution.
- Scale: nearly four billion ad bids on one platform between March and June 2026. Ads with the callback code appeared in about 75,000 apps and 120,000 websites. Confiant estimated roughly 10 million ads a day.
- Ads appeared on networks of NATO, the UN, EU bodies, government offices in about two dozen countries, chipmakers and news organizations. This shows reach, not proof of infection. Confiant found the ads it could tie directly to Candiru were low-volume and mostly reached home and mobile connections.
- Published IOCs include SHA-256 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8 (recovered spyware) and the domain mtrtb[.]com (Discover-Tech ad server). Further indicators, including C2 servers, are in Confiant's report.
Remediation
- Block the published indicators and search logs and telemetry for them.
- Hunt for the connection sequence: a device contacting a Discover-Tech ad server, then a Candiru screening server, then a C2 server.
- Organizations whose staff may have seen the ads, especially those on the networks named in the report, should prioritize this review.
Linha do tempo
-
Citizen Lab links Candiru zero-click spyware infections at Al Jazeera to malicious ads served via Discover-Tech
ler a análise desta fonte ocultar
Citizen Lab reported that Israeli mercenary spyware vendor Candiru infected devices at Al Jazeera through targeted online ads that needed no user interaction. It calls this the first public technical confirmation of mercenary spyware reaching real devices via ad delivery. At least 45 Al Jazeera devices were targeted in 2024 and 2025, and Citizen Lab attributes the activity to Candiru with high confidence. It did not name the government customer behind the operation. The ads were placed by Discover-Tech, an Israeli firm posing as a legitimate ad company. Google, IAB Europe and several ad platforms removed it in early October 2026 after being notified.
Technical Details
- Each ad carried a small callback script that sent the device's advertising ID and IP address to a Discover-Tech server. The script ran as soon as the ad loaded, sometimes in the background.
- That server decided whether the device was a target. For targets it returned attack code to the browser or app; for non-targets it returned nothing. Because the ads carried no malicious code, ad networks had nothing to detect.
- Al Jazeera traffic logs showed a consistent sequence on infected devices: a Discover-Tech ad server, then a Candiru screening server, then a command-and-control server running the spyware.
- Researchers recovered the spyware from one device but not the browser or app exploit. The initial compromise step is inferred from how the attack was set up, not from captured code.
- A Windows program file pulled from a compromised device shares distinctive techniques with a Candiru tool Citizen Lab analyzed in 2021, which underpins the high-confidence attribution.
- Scale: nearly four billion ad bids on one platform between March and June 2026. Ads with the callback code appeared in about 75,000 apps and 120,000 websites. Confiant estimated roughly 10 million ads a day.
- Ads appeared on networks of NATO, the UN, EU bodies, government offices in about two dozen countries, chipmakers and news organizations. This shows reach, not proof of infection. Confiant found the ads it could tie directly to Candiru were low-volume and mostly reached home and mobile connections.
- Published IOCs include SHA-256 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8 (recovered spyware) and the domain mtrtb[.]com (Discover-Tech ad server). Further indicators, including C2 servers, are in Confiant's report.
Remediation
- Block the published indicators and search logs and telemetry for them.
- Hunt for the connection sequence: a device contacting a Discover-Tech ad server, then a Candiru screening server, then a C2 server.
- Organizations whose staff may have seen the ads, especially those on the networks named in the report, should prioritize this review.