Al Jazeera Media Network said it "condemns the targeting of devices belonging to several of its employees with spyware" and called the action an "assault on press freedom and the public's right to knowledge". The network pledged to protect its employees and systems and called for those responsible to be held accountable.
The Citizen Lab, based at the University of Toronto, concluded that Discover-Tech purchased advertisements embedded with spyware, directing devices to Candiru's malware. The attack exploited a zero-click method, meaning no user action was required to install the malicious software.
Al Jazeera's internal technology team first detected unusual patterns on some journalists' devices in 2024, with the activity continuing into 2025. The network contacted Citizen Lab for a detailed investigation. Researchers analysed network logs provided by Al Jazeera, which they said gave a "clear temporal signature" of how the attack was executed.
Candiru, an Israeli spyware firm, was blacklisted by the United States government in 2021 for its malicious cyber activities. Its spyware has previously been used to surveil at least 100 journalists, dissidents and others across multiple countries.
Separately, New York-based security firm Confiant reported that some of Discover-Tech's advertisements also appeared on critical networks used by the Pentagon, the International Atomic Energy Agency and the International Criminal Court, raising further concerns about the scope of the targeting.