What Happened
Citizen Lab at the University of Toronto linked zero-click infections on Al Jazeera devices to Candiru, an Israeli spyware maker. The Hacker News reports the finding is the first public technical confirmation of mercenary spyware reaching real devices through targeted ads.
Ad company Discover-Tech ran the delivery. Each ad sent the device’s advertising ID and IP address to a Discover-Tech server. The server decided whether the device was a target, and only targets received attack code. The ads themselves held nothing harmful, so ad networks saw nothing to block. At least 45 Al Jazeera devices were targeted in 2024 and 2025. On one platform, Discover-Tech placed nearly four billion bids between March and June 2026. Google removed the company from its ad exchange, and IAB Europe, Beeswax, Vungle, and Eskimi acted as well. Researchers recovered the spyware from one device but not the initial exploit.
Why This Matters for Canadian Organizations
This is a Canadian research finding, and it describes a delivery method with no clicks and no warning. The report does not name Canadian victims. It does show ads on networks tied to government offices in about two dozen countries, and the researchers state an ad appearing there does not mean anyone was infected. Journalists, diplomats, policy staff, lawyers, and executives in Canada fit the profile of people who attract this kind of targeting.
The finding also weakens a common defence. Staff avoid suspicious links, but a normal news page now serves as the entry point. A compromised phone exposes email, messages, and client files, and this raises a PIPEDA safeguards question for the employer.
What to Do
Block the published indicators, including the recovered sample’s SHA-256 hash and the domain mtrtb[.]com. Confiant’s report lists the full set of command-and-control servers. Search DNS and proxy logs for the connection sequence from a Discover-Tech ad server to a Candiru screening server to a command-and-control server. Keep mobile operating systems current. Enable hardening modes, such as Lockdown Mode on Apple devices, for high-risk staff. Apply DNS-level ad filtering on managed phones. Follow our Trends coverage for further threat reporting.
