An advertisement can now do more than follow someone around the internet. Citizen Lab researchers have documented infections at Al Jazeera in which simply displaying a targeted advertisement delivered Candiru spyware. Their October investigation exposes a security problem embedded in the machinery that finances much of the web. For journalists, protecting a source may depend on systems far beyond the newsroom’s control.
The researchers identified an Israeli advertising company, Discover Tech, as an intermediary connecting surveillance vendors with advertising networks. Its targeting platform could help identify devices and deliver malicious code without requiring users to open a suspicious attachment. That finding changes the question facing publishers: checking their own editorial systems is insufficient when outside advertising suppliers can introduce hostile software. It also makes familiar advice about avoiding questionable links inadequate for this particular attack method.
A parallel investigation by advertising security company Confiant traced a concealed command channel and extensive device identification capabilities within the advertising supply chain. Its analysis describes techniques for distinguishing real users from automated inspection tools. The implication is troubling: an advertisement can appear harmless to a scanner while behaving differently for a selected visitor. Effective oversight therefore requires scrutiny of delivery systems as well as the advertisements initially submitted.
Governments already know the risks associated with these vendors. The US Commerce Department restricted exports to Candiru and NSO Group in 2021 after finding evidence that their spyware enabled malicious targeting of journalists, activists and officials. The newer findings raise a practical question about enforcement across corporate networks and commercial intermediaries. Restricting a named supplier offers limited reassurance if essential distribution channels remain accessible.
The consequences extend beyond any single newsroom. Amnesty International confirmed that Angolan journalist Teixeira Cândido’s phone was infected with Predator spyware in 2024, in a separate case involving a different product and delivery method. His account described a lasting loss of confidence in private communications. Such damage can outlive the infection itself, discouraging reporting and making potential sources fear contact.
Accountability must follow the evidence carefully. Identifying Israeli suppliers does not establish which government ordered the Al Jazeera operation, and the published investigation did not resolve that question. Regulators should examine the vendors, intermediaries and advertising platforms that enabled access, while publishers demand clearer information about what third parties execute on readers’ devices. The central test is whether commercial surveillance can continue buying its way into ordinary online activity without meaningful scrutiny.
Original analysis inspired by Richard Silverstein from The New Arab. Additional research and verification conducted through multiple sources.
