The ad a journalist never had to click
Citizen Lab’s AdFection findings distinguish targeted devices from confirmed infections. Graphic: Neal Notes. Source: Citizen Lab’s October 15, 2026 investigation. Original Neal Notes layout and paraphrase. · Source.
An advertisement can load before a reader has given it a thought. That ordinary moment in web browsing is the starting point for Citizen Lab’s October 15 investigation into spyware delivered through targeted advertising.
The researchers found that at least 45 devices at Al Jazeera were targeted in 2024 and 2025. They documented infections involving advertisements purchased by Discover-Tech and spyware from Candiru, which now uses the name Integrity Labs. Displaying a specially targeted ad could initiate the attack without a click.
Following the advertising trail
A companion investigation by the advertising-security company Confiant began with an ad detected in its scanner on April 12. Its researchers traced code that profiled devices and connected to infrastructure attributed to Candiru. The route involved systems built to deliver ads to particular people, put to a more invasive use.
At least 45 Al Jazeera devices were targeted; that is not a count of infected journalists. Nor does exposure to an ad elsewhere in the network establish, by itself, that a device was infected.
The Committee to Protect Journalists notes that the investigation did not identify the government or client that ordered the Al Jazeera attacks. CPJ has called on the relevant authorities to investigate. It said Discover-Tech and Candiru had not responded to its requests for comment; Citizen Lab also reported receiving no reply from either company before publication.
A decision for the newsroom
A warning about suspicious messages offers little help against an attack delivered through ordinary advertising. Newsrooms need to examine what they allow onto work devices and how they help staff reduce exposure. Freelancers doing the same work need access to that advice, too.
CPJ’s practical guidance describes ways to limit advertising identifiers, review location permissions, and reduce tracking. It also explains the limits of browser ad blockers, which do not protect activity inside other apps. Journalists facing an elevated threat should seek advice suited to their work and devices.
The security review should include reporters using personal phones and freelancers who have no IT department to call. They should not have to work out the implications of this investigation alone.