TORONTO — A device at Al Jazeera did not need anyone to click anything to be hacked. Loading a web page with an ad on it was enough, according to a report published Thursday that traces the attack to an Israeli advertising company.
The company, DiscoverTech of Tel Aviv, has for years secretly helped spyware developers place hacking software on popular websites, researchers at Citizen Lab, a University of Toronto research group, and the US ad security firm Confiant say. At least 45 devices at Al Jazeera were targeted in 2024 and 2025, and the hacks had not been reported until now.
It is the first time researchers have shown online ad platforms being used to hack visitors’ devices without their knowledge, NBC News reported. Natalia Krapiva of the digital rights group Access Now, who read the report, said any time people browse or open an app, “all the data on our device can be hacked by malicious actors without us even knowing.” She urged states and tech companies to take urgent measures. Such mercenary spyware is often leased to governments.
As NBC News described the report, DiscoverTech ran a separate, unadvertised program called Controlium that let spyware companies pick specific people to infect by their phones’ advertising IDs, browser identifiers or IP addresses. Researchers found its source code on DiscoverTech’s login pages; the program is not mentioned on its website. Candiru, an Israeli spyware company now operating as Integrity Labs, used the ads to deliver its software. The US Commerce Department put Candiru on its Entity List in 2021, saying foreign governments had used its software to target journalists, activists and officials.
DiscoverTech serves ads on almost 200,000 websites and apps, including those of major media organizations, search engines and government agencies. Confiant saw its ads on networks run by the US Defense Department and the Dutch Economic Affairs Ministry, though the report stresses that an ad’s presence does not mean those organizations were targeted. Five ad vendors and industry bodies have cut it off. Google, which helped the investigation, says DiscoverTech is now banned on Google Ads, and IAB Europe has suspended it.
It is not the first time Al Jazeera has been a target. Al Jazeera’s own reporting in 2020 described Pegasus spyware infecting the phones of 36 of its journalists, producers, anchors and executives, and Citizen Lab said then that the tool came from another Israeli firm, NSO Group. This time, NBC’s account does not say who used DiscoverTech’s tool against the network. Al Jazeera, DiscoverTech and its chief executive did not respond to requests for comment.
Wolfie Christl, a Citizen Lab researcher on the report, says ad blocking should count as a cybersecurity best practice and recommends resetting or disabling the advertising ID on phones. Even then, he said, it is “difficult, if not almost impossible, to consistently protect yourself from malicious ads.”
