---
title: "Al Jazeera AdFection spyware infections"
description: "Citizen Lab linked spyware infections at Al Jazeera in 2024–2025 to targeted advertisements delivering Candiru malware."
incident_type: "Malware incident"
status: "active"
last_modified: "2026-10-17"
canonical_url: "https://www.ally.security/incidents/al-jazeera-adfection-spyware-2024"
markdown_url: "https://www.ally.security/incidents/al-jazeera-adfection-spyware-2024.md"
stix_url: "https://www.ally.security/incidents/al-jazeera-adfection-spyware-2024/stix.json"
---

# Al Jazeera AdFection spyware infections

Direct technical research documents spyware delivery through advertisements at Al Jazeera.

Last modified Oct 17, 2026 · 1 source

## Summary

- **Environment:** Devices reached through targeted advertisements
- **Operational impact:** Spyware infections confirmed; at least 45 devices targeted
- **Financial impact:** No financial loss quantified in the reviewed evidence

## What happened

[Citizen Lab](https://citizenlab.ca/) found that devices at [Al Jazeera Media Network](https://network.aljazeera.net/en) were infected through malicious advertisements in 2024–2025. Its [AdFection report](https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/) links the recovered implant to Candiru spyware with high confidence. [1](#source-1)

## Impact

At least 45 devices were targeted. That figure does not establish the number of successful infections or affected people. Logs and a recovered Windows implant support the finding of compromise. [1](#source-1)

The reviewed evidence does not quantify stolen information, financial losses or service disruption.

## Timeline

### October 15, 2026 — Technical report published

The lab published its [investigation](https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/). [1](#source-1)

### October 17, 2026 — Briefing updated

This briefing was last reviewed and updated on October 17, 2026.

## Threat Group & Attack Vector

Rendering selected advertisements delivered the attack without a click. Infected devices contacted advertising infrastructure, a spyware validator, then command-and-control servers. [1](#source-1)

### Actors

- The spyware-family assessment does not identify the government or operator behind the targeting.

### TTPs

- [T1189 — Drive-by Compromise](https://attack.mitre.org/techniques/T1189/): malicious advertising delivered the infection chain. [1](#source-1)

## Response

Citizen Lab reported that advertising intermediaries removed, suspended or blocked Discover-Tech access following disclosure of the findings. [1](#source-1) The reviewed report does not establish Al Jazeera's recovery date.

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/al-jazeera-adfection-spyware-2024/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware

research · The Citizen Lab · Oct 15, 2026

<https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Al Jazeera AdFection spyware infections: Citizen Lab reported at least 45 targeted devices at Al Jazeera; this is not an exact count of infected devices or people.
2. **Affected Organization · 100% confidence · current**  
   Al Jazeera AdFection spyware infections: Al Jazeera Media Network
3. **Resulted In · 100% confidence · current**  
   Technical findings published: Citizen Lab published its direct technical findings.
4. **Resulted In · 100% confidence · current**  
   Al Jazeera AdFection spyware infections: Logs from infected devices showed contact with Discover-Tech ad infrastructure, then a spyware validator, and finally command-and-control infrastructure.
5. **Occurred At · 100% confidence · current**  
   Technical findings published: 2026-10-15
6. **Resulted In · 100% confidence · current**  
   Al Jazeera AdFection spyware infections: Technical findings published
7. **Used Attack Technique · 100% confidence · current**  
   Al Jazeera AdFection spyware infections: https://attack.mitre.org/techniques/T1189/
8. **Disclosed At · 100% confidence · current**  
   Al Jazeera AdFection spyware infections: 2026-10-15
9. **Used Malware · 100% confidence · current**  
   Al Jazeera AdFection spyware infections: Candiru spyware
10. **Resulted In · 100% confidence · current**  
   Al Jazeera AdFection spyware infections: Citizen Lab found that Al Jazeera devices were targeted in 2024 and 2025 and confirmed spyware infections using network logs supplied by the organization and a sample recovered from a compromised device.
11. **Resulted In · 100% confidence · current**  
   Al Jazeera AdFection spyware infections: Citizen Lab attributed the recovered Windows implant to the Candiru spyware family with high confidence based on distinctive persistence, obfuscation and connectivity behavior.
12. **Resulted In · 100% confidence · current**  
   Al Jazeera AdFection spyware infections: Malicious advertisements from Discover-Tech delivered the infection chain when rendered, without requiring a user click.
13. **Resulted In · 100% confidence · current**  
   Al Jazeera AdFection spyware infections: Citizen Lab reported that Google and IAB Europe removed Discover-Tech from vendor registries in early October 2026; Google terminated its exchange access, Beeswax removed it, Vungle paused access, and Eskimi blocked its accounts and domains.

</details>