Discover-Tech Ads Delivered Zero-Click Spyware to Al Jazeera While Google Approved the Company for Six Years

Spyware got onto Al Jazeera devices through an ad that only had to load on the screen. 45 were targeted, and the owners did nothing wrong. The company behind the ad ran code on 120,768 websites, approved by Google for six years.

On October 15, two teams published the same finding on the same day. Researchers at the Citizen Lab in Toronto and the ad-security company Confiant laid out the first clear proof of something security people had warned about for years: spyware that lands on a phone or a laptop through an ordinary online ad. There was no link to click and no file to download. They gave it a name, AdFection.

The usual warning is about shady links you should not click. This one had nothing to click. The ad only had to appear on the screen. The moment it loaded, a small piece of code inside it reached out to a server and asked one question: is this the person we are looking for? If the answer was yes, the attack ran. If the answer was no, the server sent back nothing, and the reader scrolled on, never knowing an ad had checked who they were.

The company at the center of this is Discover-Tech, an Israeli firm registered in 2020. On paper it looked like any other advertising business. The books say otherwise. In four months it spent only about 109,000 dollars, the records show almost no income from selling ads, and more than a third of its budget went to promoting its own website.

It bought ad space in the same automated auctions that fund most of the free internet. And it was trusted. From 2020 until this month, Discover-Tech sat on the lists of certified and approved ad vendors kept by Google and by IAB Europe, the trade body for the industry. For six years this was a vendor in good standing. Google cut its access in early October and said it did so “for systematically violating our policies.” The trade body dropped it around the same time.

To see how an ad can carry an attack, it helps to know what happens in the half second before any ad appears. When a page or an app opens a slot for an ad, it does not pick one in advance. It holds an auction. Dozens of companies get told what device you are on and where you are, tagged with a code called your advertising ID that follows you from app to app. They bid, live, for the right to show you something. The highest bid wins, and its ad drops into the slot. This happens hundreds of billions of times a day, and it is over before the page has even settled.

Discover-Tech bid in these auctions like any other buyer. But some of the ads it won carried something extra. The instant the ad rendered, a line of code phoned home to a Discover-Tech server and handed over your advertising ID and IP address, along with the cookies on the page. The server checked those details against a target list. If your device was not on it, the reply was exactly zero bytes. If it was, you got a block of code that ran on the spot. Because the server stayed silent for the rest, the scanners that are supposed to catch bad ads had nothing to flag.

The targeting was a product, not a one-off. On Discover-Tech’s platform a customer could pick a single person by advertising ID, by browser, or by IP address, and push a chosen ad straight to that one device. Clients could run it under their own branding and limit a campaign to a single country.

The scale is the part that is hard to sit with. Between March and June of this year, the researchers counted Discover-Tech bidding on 3.77 billion ad slots and winning about 442 million. Ads carrying its code showed up in 75,373 apps and on 120,768 websites, across 161 countries. At least 718 million of those bids carried the hidden code that calls home.

The heaviest targeting landed on conflict zones and small states. Yemen drew 457 million bids. In Montenegro the ads were aimed at people more than 150 times over, counted per head of population. Confiant’s cofounder Jerome Dangu put it at 10 million ads a day, and said very likely hundreds of millions of people were touched by Discover-Tech. In the Palestinian territories, he said, the ads were hard to avoid. Most of those ads were ordinary. But the same channel that carried a harmless Sudoku ad to one phone carried spyware to a target on another, and from the outside the two looked the same.

It was not only far away. In the Netherlands, 1 in 54 ads shown on iPhones came from Discover-Tech. Belgium was the single most-targeted country Confiant counted, 56 percent of all the hits, first seen on April 12.

A second trick makes it worse. Ad companies swap data with each other through something called cookie matching, a quiet arrangement that lets them recognize the same person across different sites. Discover-Tech could even follow people onto sites where its own ads never ran. Once you are in the system, stepping out of it is not up to you.

The proof that this was more than theory came from Al Jazeera. The network’s own technology team noticed odd patterns on some journalists’ devices back in 2024, and the pattern kept running into 2025. They brought in the Citizen Lab. The investigators found at least 45 devices inside the network had been targeted, and confirmed that some were infected. The logs showed the same sequence: first contact with a Discover-Tech ad server, then a check-in with a second server, then the device talking to the machine that runs the spyware. The team pulled one infected Windows file off a device. It survives a reboot by editing a Windows setting so it loads again each time the machine boots.

The spyware itself was made by Candiru, an Israeli company that sells surveillance tools only to governments. The name is not new. In July 2021, security researchers and Microsoft mapped its work and found at least 100 victims, among them journalists, activists and dissidents, plus two holes in Windows that got patched. That November, the US government put the company on a trade blacklist, the list of firms American companies may not export to without a special license. It now calls itself Integrity Labs. Its spyware can take files, read messages, log what you type, switch on the microphone and camera, and grab screenshots.

The find that says the most about this operation is almost dull. Discover-Tech left an open page on the internet, no password, holding 128 days of sign-in records. It showed who had been signing in to the targeting platform: 120 different usernames. Two were tied to Candiru, and those two signed in from eight countries, among them the United States, Italy and the Czech Republic. And until March of this year, one of the company’s shareholders was linked to Sara Hamou. She ran the corporate network behind Intellexa, the group behind the Predator spyware, and was convicted in Greece in the case known as Predatorgate. These are not separate worlds. They overlap.

The ads did not only reach journalists. The researchers found Discover-Tech impressions inside the networks of the Norwegian parliament, the Norwegian police, the European Parliament, the European Commission, NATO and the UN. They also found ads inside the networks of 19 media organisations across eight countries. Confiant saw them on networks tied to the Pentagon, the UN’s atomic agency, and the International Criminal Court. One caution here: an ad showing up on a network is not the same as a device being infected. It means the door was knocked on, not that someone walked through. But it shows how far the reach went.

And most of the ads tied to Candiru did not land on government networks at all. They landed on ordinary home and mobile connections, in living rooms. Whoever sat in their database could be reached on their own phone, whatever network they used.

The spyware was not the only thing these ads carried. A second group, which the researchers call Dark Cartographer, used the same platform to match the advertising IDs in those bid requests to people’s phone numbers, by abusing weak spots at mobile carriers in more than 30 countries. The researchers say a separate report on that group is still coming. The same system served at least two operations at once.

A few things are still open. Confiant caught the script that does the groundwork, about 90 KB of code that poses as an ordinary verification check, fingerprints the device, and can run whatever the operators send it. The code even carried a fake line, “Copyright 2013 Google Inc.”, to put human reviewers at ease. The final break-in, the step that takes over the machine, has not been caught in the wild. Whether the servers that handed out the attack are still running, the report does not say. Discover-Tech and its spyware supplier were both asked to respond and stayed silent.

An attack that needs nothing from you still leaves you something to do. You cannot un-see an ad, but you can stop it from loading, and you can make yourself harder to single out.

• → Run an ad blocker in your browser, and if you can, block ads and trackers on your router, so the devices in your home are covered at once. This is the step that also protects a laptop, and that attack hit Windows laptops, not phones.
• → On your phone, take away your advertising ID, the code that lets someone pick you out of the crowd. On Android it is Settings, then Privacy, then Ads, then Delete advertising ID. On an iPhone it is Settings, then Privacy and Security, then Tracking, then turn off Allow Apps to Request to Track. After that, an app that asks for the ID gets back a row of zeros.

None of this makes you invisible. But it takes away the handle this kind of attack grabs, and it shuts down a lot of ordinary tracking along the way. The bigger lesson sits with the system, not with you. For six years a company could stand inside the advertising machine that funds the free internet, pass the checks, keep its seal of approval from the biggest names in the business, and use that same machine to drop spyware on a reporter’s laptop. The auction was built for speed and reach, not for asking who is buying. Until that changes, “don’t click” belongs to an older internet.

Want to see exactly what your own phone and browser hand over the moment an ad loads?

My Ethical Hacking Complete Course Zero to Expert takes you there step by step: reconnaissance, scanning, exploitation and traffic analysis, hands-on, from your first day with no Linux or hacking background.

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

The Citizen Lab | Confiant