As reported by The Hacker News, Citizen Lab has published the first public, technical confirmation that mercenary spyware was delivered to real devices through targeted online advertising. At least 45 devices at Al Jazeera were compromised in 2024–2025 by Candiru, an Israeli commercial spyware vendor, using zero-click exploit code embedded in programmatic ad delivery. This is not an incremental development — it is a structural shift in how the surveillance-for-hire industry operates.

Threat Intelligence: At least 45 devices at Al Jazeera were compromised in 2024–2025 by Candiru, an Israeli commercial spyware vendor, using zero-click exploit code embedded in programmatic ad delivery.

What makes this campaign significant is not the spyware itself — Candiru has been tracked since at least 2021 — but the delivery mechanism. By weaponizing the programmatic advertising supply chain, the operators achieved something that has long been theorized but never before documented in a live attack: a zero-click, scalable, and nearly undetectable distribution path that abuses legitimate infrastructure trusted by billions of devices.

Why the Ad-Tech Vector Changes the Threat Landscape

The attack chain described by Citizen Lab is elegant in its simplicity. A front company, Discover-Tech, was registered in Israel in 2020 and maintained legitimate standing with Google and IAB Europe as an approved ad vendor for roughly five years. Ads served by Discover-Tech carried a small fingerprinting payload that transmitted the device's advertising ID and IP address to a decisioning server. If the device matched a target profile, the server returned browser or app exploit code. If not, nothing happened.

The ad itself carried no attack code. The ad networks that delivered it had nothing harmful to detect. The exploit was server-side and target-specific, meaning detection had to occur at the endpoint or network egress — not within the ad pipeline.

This design defeats conventional ad-fraud and malvertising detection systems. Security scanners that inspect ad creatives for malicious payloads would find nothing. The attack code exists only in transit, only for targeted devices, and only for a brief window. For non-targets, the infrastructure is indistinguishable from any other ad-tech vendor.

Who Is Most at Risk

Who Is Most at Risk
Journalists and media organizations — Al Jazeera has now been targeted by two separate mercenary spyware operations (NSO Group's Pegasus in 2020, Candiru in 2024–2025). Newsrooms covering conflict, human rights, or geopolitics remain primary targets.
Human rights defenders and dissidents — The targeting model is scalable. Any entity that can place ads through a front company can build a target list and deliver exploits through the same infrastructure.
Government officials and diplomats — Particularly those operating in regions where mercenary spyware procurement is poorly regulated.
Any organization whose threat model includes state-aligned adversaries — The ad-tech vector bypasses many traditional network controls because ad traffic is ubiquitous and trusted.

Broader Implications for the Ad-Tech Ecosystem

Discover-Tech maintained approved vendor status with Google and IAB Europe for approximately five years. This is not a failure of a single platform — it is a systemic gap. The programmatic advertising ecosystem processes billions of ad requests per day across thousands of intermediaries, and the due diligence infrastructure is not designed to detect nation-state-grade operational front companies that maintain clean operations for years before activating.

The ad-tech supply chain now joins the ranks of other trusted infrastructure that has been systematically abused for surveillance: mobile push notification services, telecom SS7 networks, and MDM provisioning systems. Each of these shares the same fundamental problem — they were designed for scale and interoperability, not for adversarial resilience.

Shield53 Recommendations

  • Deploy network-level ad domain blocking for high-risk users. DNS filtering or firewall rules that block known ad-tech domains for devices belonging to journalists, executives, and other elevated-risk personnel will eliminate this attack vector entirely. This is the single most effective mitigation.
  • Monitor egress traffic for anomalous ad-server connections. The Citizen Lab findings show a consistent pattern: Discover-Tech ad server contact followed by Candiru screening server contact followed by C2 communication. Network telemetry that correlates ad-delivery domains with subsequent unusual outbound connections can flag compromised devices before spyware completes its mission.
  • Implement mobile threat defense (MTD) on managed devices. Traditional MDM does not detect zero-click browser exploits. Dedicated mobile threat defense solutions that monitor for post-exploitation behavior — unexpected process spawning, privilege escalation, anomalous network connections — are necessary for high-risk populations.
  • Audit ad-tech vendor exposure. Organizations that serve ads or participate in programmatic exchanges should review their vendor lists for entities with thin operational histories, Israeli incorporation patterns matching known front companies, or connections to the surveillance industry.
  • Adopt compartmentalized browsing for sensitive work. High-risk users should separate ad-supported browsing from work-related activity using isolated browser profiles, dedicated devices, or sandboxed environments. If an exploit never loads because no ad is rendered in the working context, the attack fails.
  • Engage in threat intelligence sharing. The Citizen Lab analysis was only possible because Al Jazeera shared its traffic logs. Organizations in high-risk sectors should establish relationships with reputable research groups before an incident occurs, not after.

The mercenary spyware industry has demonstrated that it can weaponize the infrastructure of the open internet — the same ad networks that fund free content — to reach targets with surgical precision. Defenders must accept that the perimeter is no longer the network edge. The perimeter is now every screen that loads content from a third party.