Israeli ad-tech firm helped place spyware on Al Jazeera devices

Citizen Lab investigation says dozens of Al Jazeera devices were infected by malware planted through advertisements.

Al Jazeera says it will continue to take appropriate measures to protect staff and systems after an attempt to spy on employees [Showkat Shafi/Al Jazeera]

Israeli advertising technology company Discover-Tech helped place spyware on dozens of devices used by Al Jazeera and other companies.

Al Jazeera Media Network on Thursday said it “condemns the targeting of devices belonging to several of its employees with spyware” and pledged to continue to “protect its employees and systems”.

The network said targeting journalists is an “assault on press freedom and the public’s right to knowledge” and called for those responsible to be held accountable.

A Citizen Lab investigation, prompted by Al Jazeera’s initial internal probe into the issue, has confirmed that spyware from Candiru, an Israeli spyware firm blacklisted by the United States government in 2021 for its malicious cyber activities, was planted on these devices, using the first-known instance of “zero-click” targeted advertising.

The nature of installing this spyware means that once an infected advertisement appears on a device, that device, too, is infected – spying on, and feeding, all the data and information available on that platform to those stealing it.

The malicious software is designed to collect a wide range of sensitive data, including files, documents, and browser data such as cookies, bookmarks, and saved credentials. It can also capture keystrokes, take screenshots, record microphone and webcam input, and extract emails and messages from popular communication platforms.

To avoid triggering security mechanisms, the spyware often uses encrypted communication channels and breaks up stolen data into smaller chunks sent over time.

The particular tool used is understood to have cost several million dollars.

The incident highlights the sophisticated nature of threats posed by groups like Candiru, and their customers, who use techniques to bypass modern security defences.

The Citizen Lab, a research unit at the University of Toronto, concluded in its report that Discover-Tech purchased the advertisements with built-in spyware. It then directed devices to Candiru’s malware through these advertisements.

Al Jazeera journalists were among the millions whose devices were targeted – including several who reported on sensitive subjects.

Al Jazeera’s in-house technology team first discovered unusual patterns on devices used by some journalists in 2024. The pattern continued into 2025. Al Jazeera reached out to Citizen Lab for a more detailed investigation into its suspicions that spyware was responsible for the activity.

“Analysis of network logs provided to the Citizen Lab by Al Jazeera collected during the attack period provides a clear temporal signature of how the attack was executed,” the University of Toronto-based team said in its report published Thursday.

Al Jazeera said that the cooperation “contributed to verifying these attacks and publicly documenting them”.

Meanwhile, New York-based advertising security firm Confiant said in a separate report that some of Discover-Tech’s advertisements also appeared in critical networks used by the Pentagon, the United Nations International Atomic Energy Agency and the International Criminal Court.

Candiru’s spyware has previously been used to carry out surveillance on at least 100 journalists, dissidents and others in several countries.

公民实验室的调查显示，数十台半岛电视台的设备感染了通过广告植入的恶意软件。

半岛电视台表示，在发生员工遭窃听事件后，将继续采取适当措施保护员工和系统安全。[Showkat Shafi/半岛电视台]

以色列广告技术公司 Discover-Tech 帮助半岛电视台和其他公司在数十台设备上安装了间谍软件。

半岛电视台周四表示，“谴责针对其多名员工设备的间谍软件攻击”，并承诺将继续“保护其员工和系统”。

该媒体表示，针对记者的行为是“对新闻自由和公众知情权的攻击”，并呼吁追究肇事者的责任。

受半岛电视台对该问题进行初步内部调查的启发，公民实验室展开了调查，证实这些设备上植入了来自以色列间谍软件公司 Candiru 的间谍软件。Candiru 因其恶意网络活动于 2021 年被美国政府列入黑名单。此次调查使用了已知的首例“零点击”定向广告。

安装这种间谍软件的性质决定了，一旦受感染的广告出现在设备上，该设备也会被感染——监视并向窃取该平台上所有数据和信息的人提供这些数据和信息。

该恶意软件旨在收集各种敏感数据，包括文件、文档和浏览器数据，例如 Cookie、书签和已保存的凭据。它还可以捕获键盘输入、截取屏幕截图、录制麦克风和摄像头输入，以及从常用通信平台提取电子邮件和消息。

为了避免触发安全机制，间谍软件通常会使用加密通信通道，并将窃取的数据分成较小的块，随着时间的推移发送。

据了解，所使用的这件特殊工具价值数百万美元。

该事件凸显了像 Candiru 这样的组织及其客户所构成的威胁的复杂性，他们利用各种技术绕过现代安全防御措施。

多伦多大学下属研究机构公民实验室在其报告中得出结论，Discover-Tech公司购买了内置间谍软件的广告。然后，该公司通过这些广告将设备引导至Candiru恶意软件。

半岛电视台记者是数百万设备遭到攻击的用户之一，其中包括几位报道敏感话题的记者。

半岛电视台的内部技术团队在 2024 年首次发现一些记者使用的设备上存在异常模式。这种模式一直延续到 2025 年。半岛电视台联系了公民实验室，希望对其怀疑的间谍软件是造成这种现象的原因进行更详细的调查。

多伦多大学的研究团队在周四发布的报告中表示：“对半岛电视台在攻击期间向公民实验室提供的网络日志进行分析，可以清晰地展现攻击是如何执行的时间特征。”

半岛电视台表示，这种合作“有助于核实这些袭击事件并公开记录下来”。

与此同时，总部位于纽约的广告安全公司 Confiant 在另一份报告中表示，Discover-Tech 的一些广告也出现在五角大楼、联合国国际原子能机构和国际刑事法院使用的关键网络中。

Candiru 的间谍软件此前曾被用于对多个国家的至少 100 名记者、异见人士和其他人士进行监视。