Citizen Lab Traces Spyware Campaign on 45 Al Jazeera Journalists to Israeli Firms Candiru and Discover-Tech

Citizen Lab, the digital-forensics watchdog at the University of Toronto, published findings last week on a malware campaign it calls Adfection. Researchers found it on the computers of 45 Al Jazeera journalists. The spyware required no click, no download, and no user error. It arrived embedded in ordinary web ads.

According to the investigation, the malicious code was written by Candiru, an Israeli spyware developer previously sanctioned by the United States. Ads carrying the payload were purchased and placed by a second Israeli firm, Discover-Tech, through an advertising platform called Controlium. Citizen Lab's report describes Controlium as capable of stripping the anonymity of a target even when that person has encrypted or masked their traffic, and of tracking devices across cellular, Wi-Fi and VPN connections.

Citizen Lab describes Discover-Tech as presenting itself as a legitimate ad company while functioning, in the researchers' assessment, as a vehicle for large-scale espionage.

Once a targeted device loaded one of the infected ads, it was redirected to Candiru's servers, where the harvested data, including email, text messages, audio, video and browsing activity, was collected for what the report calls large-scale tracking and reconnaissance.

Scale and targets

Discover-Tech placed roughly 4 billion ad bids across some 200,000 Android and Apple apps and websites, Citizen Lab found. The campaign reached users in 23 countries. Documented targets included NATO, the Pentagon, the International Criminal Court, the European Parliament, and Israeli government ministries covering foreign affairs, defense and police, according to the report.

A company that keeps changing its name

Citizen Lab traced Candiru's corporate history through a string of rebrandings since its 2014 founding. The firm now operates as Integrity Labs, with a website claiming a Hong Kong base and offices across Asia. The report notes no mention of Herzliya, Israel, where Candiru was founded and where its chief executive is based. Citizen Lab describes this geographic repositioning as a buffer built to distance operations from U.S. sanctions imposed on Candiru while the underlying surveillance tools continue to be deployed.

What Citizen Lab did not say

Citizen Lab's report stops short of naming the government or agency that commissioned or ran the Adfection campaign. The New Arab's opinion piece, which first surfaced the report in this context, argues that Israel's Unit 8200 signals-intelligence branch is the most likely architect, pointing to the unit's mission and Israel's documented interest in several of the targeted institutions, including the ICC and Al Jazeera. That attribution is the author's inference, not a Citizen Lab finding, and remains unconfirmed.

The broader picture is less disputed. Candiru sits within a cluster of Israeli surveillance firms, alongside NSO Group and others, whose founders and senior staff have documented ties to Unit 8200, and whose products have repeatedly surfaced in forensic investigations of attacks on journalists, human rights defenders and government bodies worldwide. Candiru itself was placed on the U.S. Commerce Department's sanctions list in 2021 over spyware abuses. The Adfection findings mark the latest instance of a company under American sanctions reappearing, under a new name, in an active surveillance operation that reached a global media organization and multiple Western governments.