Discover-Tech—Discover-Tech's Controlium ad platform delivered Candiru/Integrity Labs zero-click spyware that infected 45+ Al Jazeera journalist devices
Citizen Lab's October 15, 2026 'Exposing AdFection' report found that Israeli ad-tech company Discover-Tech operates a platform called Controlium that de-anonymizes and fingerprints users via mobile advertising identifiers, browser identifiers, and IP addresses, then delivers 'controlled ads' capable of zero-click infection -- devices are compromised automatically when the ad is displayed, with no user interaction required. Citizen Lab traced a malware sample recovered from a compromised Al Jazeera device through a documented infection chain: contact with Discover-Tech ad infrastructure, then a Candiru validator server, then a Candiru command-and-control server, matching the attack signature of Candiru (rebranded as 'Integrity Labs' after its 2025 acquisition by Integrity Partners). At least 45 Al Jazeera devices were infected between 2024 and 2025. Discover-Tech-served ads carrying this capability also reached networks in Austria, Denmark, France, Mexico, Israel, Italy, Norway and Sweden, including government ministries, security agencies, NATO and the UN, though no client or government customer was publicly named as having ordered the specific attacks. Al Jazeera called the targeting 'an attack on press freedom and on the public's right to know'; neither Discover-Tech nor Candiru/Integrity Labs responded to requests for comment.
Scoring Impact
| Topic | Direction | Relevance | Contribution |
|---|---|---|---|
| Digital Safety for Vulnerable Users | -against | secondary | -0.50 |
| Press Freedom | -against | secondary | -0.50 |
| Surveillance Technology | +toward | primary | -1.00 |
| Overall incident score = | -0.883 | ||
Score = avg(topic contributions) × significance (critical ×2) × confidence (0.66)
Evidence (2 signals)
Citizen Lab's 'Exposing AdFection' report traced zero-click spyware infections of Al Jazeera devices to Discover-Tech's Controlium ad platform
University of Toronto-based Citizen Lab published a technical report on October 15, 2026 documenting how Discover-Tech's Controlium ad-tech platform de-anonymizes and fingerprints devices, then delivers malicious ads that infect them with Candiru/Integrity Labs spyware with zero user interaction, recovering a malware sample from a compromised Al Jazeera device with hardcoded command-and-control infrastructure matching Candiru's known attack chain.
CPJ and Al Jazeera confirmed at least 45 Al Jazeera devices were targeted via Discover-Tech-facilitated spyware ads
The Committee to Protect Journalists reported on Citizen Lab's findings on October 15, 2026, noting at least 45 Al Jazeera devices were infected and that CPJ called on Israeli authorities and the ad industry to investigate and prevent advertising infrastructure from enabling targeted surveillance; Al Jazeera confirmed it cooperated with Citizen Lab after detecting unusual device behavior in 2024 and called the targeting an attack on press freedom.