Israeli ad-tech firm helped place spyware on Al Jazeera devices

Israeli advertising technology company Discover-Tech helped place spyware on dozens of devices used by Al Jazeera and other companies.

Al Jazeera Media Network on Thursday said it “condemns the spyware attacks targeting a number of its staff” and pledged to continue to “protect its employees and systems”.

list 1 of 4 Suspected Israeli online operations cause alarm in Iran and Lebanon

list 2 of 4 Saudi national charged with planting a listening device at OpenAI offices

list 3 of 4 Russia arrests Japanese journalist on suspicion of ‘espionage’

list 4 of 4 Russia’s arrest of Japanese journalist: Why are tensions rising?

The network said targeting journalists is an “assault on press freedom” and called for those responsible to be held accountable.

A Citizen Lab investigation, prompted by Al Jazeera’s initial internal probe into the issue, has confirmed that spyware from Candiru, an Israeli spyware firm blacklisted by the United States government in 2021 for its malicious cyber activities, was planted on these devices, using the first-known instance of “zero-click” targeted advertising.

The malicious software is designed to collect a wide range of sensitive data, including files, documents, and browser data such as cookies, bookmarks, and saved credentials. It can also capture keystrokes, take screenshots, record microphone and webcam input, and extract emails and messages from popular communication platforms.

To avoid triggering security mechanisms, the spyware often uses encrypted communication channels and breaks up stolen data into smaller chunks sent over time.

The particular tool used is understood to have cost several million dollars.

The incident highlights the sophisticated nature of threats posed by groups like Candiru, and their customers, who use techniques to bypass modern security defences.

Al Jazeera journalists were among the millions whose devices were targeted – including several who reported on sensitive subjects.

Al Jazeera’s in-house technology team first discovered unusual patterns on devices used by some journalists in 2024. The pattern continued into 2025. Al Jazeera reached out to Citizen Lab for a more detailed investigation into its suspicions that spyware was responsible for the activity.

“Analysis of network logs provided to the Citizen Lab by Al Jazeera collected during the attack period provides a clear temporal signature of how the attack was executed,” the University of Toronto-based team said in its report published Thursday.

Al Jazeera said that the cooperation “helped verify and publicly document these attacks”.

Candiru’s spyware has previously been used to carry out surveillance on at least 100 journalists, dissidents and others in several countries.