An Israeli advertising company called DiscoverTech spent years quietly helping spyware developers plant hacking software through ordinary web ads, and at least 45 devices at Al Jazeera got infected without anyone clicking a thing. The attack worked like this: visit a website, see an ad, get owned. According to a new report from Citizen Lab, it's the first time researchers have shown how the ad machinery that covers the internet can be turned into a delivery truck for malware.
Just Loading A Webpage Was Enough
Let's be clear about what "no-click" means, because it is the whole horror of this story. The victim didn't open a sketchy attachment. They didn't tap a suspicious link from a stranger. They visited a website with a vulnerable device and an ad loaded. That was it. That was the entire mistake.
The findings, first reported by NBC News, come from a joint effort between Citizen Lab, the University of Toronto group that studies mercenary spyware, and Confiant, a U.S. ad security company. The hacks hit Al Jazeera in 2024 and 2025 and went unreported until Thursday.
Al Jazeera handed over network logs from the period of the attacks, which researchers used to reconstruct how the whole thing unfolded. So this isn't a theory about what might be possible someday. It's a forensic account of what already happened to a real newsroom.
The Front Company With The Friendly Slogan
DiscoverTech is a Tel Aviv outfit that sells online advertising. Its website promises "a gateway to global fraud-free traffic, connecting your brand with real users." Fraud-free. Real users. That's the pitch.
What the company allegedly ran on the side was a separate program that let spyware companies inject malicious software onto visitors' devices. So the same pipes that deliver a mattress ad to your phone were also available for rent to people who sell tools to break into it.
The company did not respond to a request for comment. Neither did its CEO. Al Jazeera didn't respond either. Silence is a choice, and in this case it's a loud one.
Nearly 200,000 Places This Could Have Shown Up
Here's where it gets uncomfortable for everyone with a screen. The report says DiscoverTech serves ads on almost 200,000 websites, Android apps and iOS apps. That includes major media organizations, search engines, government agencies and dating services.
Confiant also detected DiscoverTech ads on networks tied to major government entities, including the U.S. Defense Department and the Dutch Economic Affairs Ministry. The researchers were careful to say that seeing the ads there does not mean those organizations were targeted. Fair. We're repeating that caveat because it's accurate. But it tells you how deep this stuff runs. The Pentagon's network was in the same ad ecosystem as a company accused of moonlighting for spyware shops.
That's the nature of ad tech. Nobody builds a single wall around it, because it was never designed as one building. It's a bazaar, and everyone's wallet is on the table.
This Is Not The First Time Al Jazeera Got Hit
Al Jazeera has been a target before. Citizen Lab previously reported that the phones of 36 Al Jazeera journalists and staff members were hacked with what it said was Pegasus spyware from a different Israeli company, NSO Group. The likely operators were linked to Saudi Arabia and the United Arab Emirates. NSO said at the time it would review the findings.
So one newsroom, one region, multiple Israeli surveillance vendors, multiple attack methods. It's a buffet. The customers pick the delivery system that suits them.
The pattern is hard to miss. Spyware companies love to describe their products as essential tools for national security. Yet the technology keeps turning up pointed at journalists, human rights advocates and political opposition. At some point the "national security" label stops being a defense and starts being a punchline.
The Industry Reacts The Way Industries React
After Citizen Lab published, five ad vendors and industry organizations disconnected DiscoverTech from their platforms. That's good. It's also the bare minimum, and it happened only after a university lab and a security firm did the detective work for free.
Natalia Krapiva, a spyware expert at the digital rights nonprofit Access Now who read the report but wasn't involved in it, put the stakes plainly: "Any time we browse the internet or open an app, all the data on our device can be hacked by malicious actors without us even knowing." She called for "urgent technical, legal and regulatory measures" from the states and tech companies whose infrastructure enables these attacks.
Notice who's doing the cleanup here. Not regulators. Not the ad exchanges that profited from the traffic. A research lab and a security vendor found the problem, and the platforms cut ties once the press was watching.
The Dingo Take
Who benefits? Start with DiscoverTech, which allegedly collected money from spyware developers while selling advertisers a pitch about fraud-free traffic and real users. Then the spyware vendors, who got a distribution channel that required zero effort from their victims. Then the governments on the buying end, who got to read the phones of reporters without ever sending a single phishing email. Everyone in that chain got paid or got what they wanted. The only ones who lost were the people being watched.
The ad industry also benefits from a system so tangled that nobody has to answer for what flows through it. Auctions happen in milliseconds, intermediaries stack on intermediaries, and the person who finally serves the poisoned ad can always point up the chain. That opacity isn't a bug. It's what makes the whole business model print money. And it's exactly why a company could allegedly run a side hustle in malware delivery for years without tripping an alarm.
Five vendors cutting ties after a press cycle is not reform. It's reputation management. Until there are real legal consequences for the companies that build and sell the plumbing for these attacks, the incentive stays the same: take the money, deny the knowledge, and wait for the next report to blow over. A journalist should be able to read a news site without wondering if the ad next to the headline is the thing that breaks into their phone. Right now, nobody can promise that.
Comments