AI-generated illustration

Citizen Lab, a research laboratory at the University of Toronto's Munk School of Global Affairs and Public Policy, published research on October 15 showing that at least 45 devices used by Al Jazeera employees were targeted in 2024 and 2025 with spyware developed by the Israeli company Candiru.

The research found that the malicious software reached the target devices through the advertising network of Discover-Tech, an Israeli digital advertising company. Because the method requires no clicking on a suspicious link or opening of a file, the findings have raised renewed concerns that online advertising systems can be used to deliver surveillance tools.

Malicious ads delivered without any clicks

Citizen Lab, which conducts independent research on digital security and human rights, said it obtained technical evidence that spyware built by Candiru was used in the attacks on Al Jazeera staff devices. Researchers reviewed network logs provided by the channel to establish how the intrusions were carried out.

The delivery method stands out because it needs no action from the user. Displaying an advertisement containing malicious code can be enough to exploit vulnerabilities on a device and install the spyware. The research indicates that online advertising systems can be used not only to track users or target audiences, but also to place spyware on chosen devices.

Discover-Tech acted as a delivery channel

Ron Deibert, founder and director of Citizen Lab, told Al Jazeera that work with the channel's information technology team helped confirm that some devices were targeted through malicious advertisements. Discover-Tech presents itself as an advertising broker, Deibert said, but the findings show the company played an intermediary role in delivering commercial spyware to targets.

About 24 media organizations worldwide also received the company's advertisements, according to Deibert. Seeing such ads on an organization's network does not by itself prove that its devices were compromised with spyware, and Citizen Lab said findings relating to other media outlets are still being examined. Deibert also noted that targeting journalists can expose news sources and reveal the subjects they are working on.

Al Jazeera condemns the attacks

The Al Jazeera Media Network said in a statement on October 15 that it condemns the targeting of some employees' devices with spyware of Israeli origin. The network said measures to protect its staff and systems are continuing, that cooperation with researchers helped verify the attacks and bring them to public attention, and that those responsible should be held to account.

Expert links the case to earlier targeting of journalists

Muhsin al-Hudeysi, a Moroccan artificial intelligence and information security expert, told an Anadolu Agency correspondent that attacks on media organizations are not isolated incidents and should be treated as part of repeated activity against outlets that threaten particular interests. "The media is an important force that forms the first line of defense in protecting social awareness and values," al-Hudeysi said, adding that media becomes one of the first targets rivals try to infiltrate or silence when it threatens certain actors' interests or ideologies.

The use of Israeli-origin software against journalists is not new, al-Hudeysi said, recalling findings that the Pegasus spyware made by the Israeli company NSO Group was used against journalists as well as heads of state and senior officials. Research published by the Pegasus Project in 2021 reported that phones of numerous Arab journalists from Morocco, Qatar, Saudi Arabia, the United Arab Emirates, Bahrain, Palestine and Lebanon were targeted with Pegasus.

Al-Hudeysi said Israel has advanced cybersecurity expertise and a range of software that can be used to monitor journalists' phones, and that this capacity can also be directed at states and public institutions to shape public opinion. Some tools can be combined with directed media activity to shift public tendencies in political and electoral processes, al-Hudeysi said, noting that spyware poses a serious risk because it can gain deep access to a device and be used again.

Advice for media workers and the wider regional threat

To strengthen their digital security, journalists and media workers should first avoid opening links and files from sources they do not know or trust, al-Hudeysi said, urging caution with messages and content from unknown people and the adoption of basic security practices to protect devices and data. Awareness of cybersecurity among media staff should be raised and advanced protection strategies developed to match emerging threats, al-Hudeysi said.

Cyberattacks on various institutions in Arab countries also remain on the security agenda. The United Arab Emirates Cybersecurity Council said in August that sophisticated and organized attacks targeting the aviation, energy and education sectors were thwarted, along with unauthorized access attempts and phishing attacks. Jordan's National Cybersecurity Center said in September that it had acted against more than 15,000 fraud and cyberattack attempts in the digital environment during 2022-2026.

Morocco-based news site Hespress, citing a Mastercard report published in mid-October, reported that cyberattacks in Africa had risen by more than 421 percent by the end of 2025 compared with 2016. The report ranked Morocco third on the continent for recorded cyber incidents, accounting for about 10.6 percent of cases in Africa. The research into the targeting of Al Jazeera devices has brought back concerns that digital advertising systems can be used for surveillance and spyware delivery, and experts stress the need for media workers to improve their digital security awareness and protective measures.

Key takeaways

• Citizen Lab said at least 45 Al Jazeera devices were targeted in 2024 and 2025 with Candiru spyware.
• The spyware was delivered through the ad network of Israeli digital advertising company Discover-Tech.
• The method requires no user interaction, since a malicious ad alone can exploit device vulnerabilities.
• Al Jazeera condemned the attacks and called for those responsible to be held to account.