Researchers link ad platform to spyware at Al Jazeera

Researchers say DiscoverTech used targeted online advertisements to deliver spyware linked to Candiru to devices at Al Jazeera, including in attacks that required no click or other action from users. Citizen Lab, a research group at the University of Toronto, said at least 45 devices at the broadcaster were targeted in 2024 and 2025. The researchers based their findings on network logs supplied by Al Jazeera and linked the attacks to Candiru with high confidence. The investigation describes how DiscoverTech’s Controlium platform could identify and profile devices using signals such as IP addresses, advertising identifiers and browser information. According to Citizen Lab, the system could then select particular devices for spyware delivery when an advertisement appeared. An ad might render in the background, and most users would see no indication of malicious activity. The researchers said the method did not require a victim to click an ad or open a file. Citizen Lab said it recovered spyware from an infected device, but not the exploit used to break into the browser or app. The research group said the attack sequence was supported by network logs and linked the spyware to...