Hardware FixRecommendedDevice not working? Your driver may be the problemCheck updates for common hardware issues.Fix DriversHalloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsSlow PC?RecommendedPC slow today? Run a repair scan before it gets worseResolve common Windows issues and optimize system performance.Scan Now×
FREEDOM251

Freedom251 › Blog › Al Jazeera

Israeli spyware reached millions of phones’ ad feeds—but not millions of confirmed infections

By Freedom251 Team · · 5 min read

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Short answer: Citizen Lab says an Israel-based advertising operation exposed millions of devices to reconnaissance linked to mercenary spyware, but it has not established that millions of phones were infected. The investigation found high-confidence evidence that at least 45 devices used inside Al Jazeera were targeted in 2024 and 2025 with Candiru spyware, now publicly rebranded as Integrity Labs.

The technique, which Citizen Lab calls AdFection, turns an ordinary online ad impression into a possible zero-click exploit. A selected target may be compromised when the ad renders, without tapping it, downloading a file or opening an attachment.

As an Amazon Associate I earn from qualifying purchases.

What Citizen Lab found on 15 October 2026

Citizen Lab’s Report 195, “Exposing AdFection,” describes Discover-Tech as an Israel-based company that presents itself as an advertising business while connecting the real-time advertising market to mercenary spyware vendors. Its analysis covered almost 200,000 unique websites and Android and iOS apps in dozens of countries during a four-month period.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • At least 45 Al Jazeera devices were targeted in 2024 and 2025. Citizen Lab attributes the operation to Candiru with high confidence.
  • Millions of devices were likely profiled as preliminary reconnaissance after their information reached infrastructure associated with the operation.
  • Most people were not selected for exploitation. The report does not provide a worldwide total of confirmed infections.

Citizen Lab calls this “the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads.” Its executive summary says the ecosystem is being used “at a massive scale to profile millions of users, then silently infect targets with zero-click mercenary spyware.” Those statements describe two different stages: broad collection and selective compromise.

#1 Best Overall
PEHAEL for iPhone 17e/16e/14/13/13 Pro Privacy Screen Protector | 3 Pack, Installation kits, Anti-Spy Private, Anti-Scratch, 9H Tempered Glass, Case Friendly, [6.1 inch]
  • [Compatible Models] - 3 Pack Privacy Glass Screen Protector for the iPhone 17e/iPhone 16e/iPhone 14/iPhone 13/iPhone 13 Pro(6.1 inch). Includes 3 privacy screen protectors and a cleaning kit. *Two types of packaging boxes are randomly shipped.
  • [Full Coverage Protection] - This screen protector offers edge-to-edge protection for your device, using military-grade explosion-proof glass. It is also compatible with most phone cases, the appropriate size ensures that the phone case won't squeeze the screen protector after installation, providing double protection for the edges of the phone.
  • [High Privacy Protection] - The necessary choice for you in public places. Select the optimal anti-peeping angles for the anti-spy coating to balance privacy and visual comfort. Protect your personal privacy and sensitive information from being seen by people nearby who might peek. To better protect your phone, 3mm nano-scale ultra-thin aviation glass is chosen as the material, it also protects your eyes from harsh light, ensuring a softer visual effect.
  • [Superior Quality] Made of high-quality tempered glass, free of bubble wrap, easy to install and no residue when disassembled. Maintain the original touch experience, with a high-definition and clear hydrophobic and oleophobic screen coating to prevent fingerprints, sweat and oil residue. High-hardness glass protects your screen from drops, impacts, scratches and breaks, providing ultimate protection for your phone.
  • [Face ID Compatible] - Precise cutting combined with high-quality glass material supports the perfect use of the Face ID function, and it can also take high-pixel photos through the front camera.

How AdFection can work without a click

  1. An ad auction occurs. Discover-Tech wins a normal real-time advertising bid for space in a website or app.
  2. The ad renders. When the page or app loads the advertisement, the operation can collect device and network information. The user does not have to tap the ad.
  3. The system sorts potential targets. Most impressions appear to be used for profiling or reconnaissance rather than exploitation.
  4. A selected impression receives malicious code. For a target that meets the operator’s criteria, the ad can return JavaScript designed to exploit a browser or app.
  5. A zero-click infection may follow. If the exploit succeeds, spyware can be installed without a download prompt, attachment or other deliberate action.

An ad impression alone cannot show that a person was selected or infected. Confirmation requires forensic examination of the device, network evidence or both.

What “millions of phones” does—and does not—mean

The “millions” figure refers to devices that were likely observed and profiled during reconnaissance. Profiling can include information about a device and its network that helps an operator decide whether a person is worth targeting. It is not an infection count.

Rank #2
Sale
Ailun Privacy Screen Protector iPhone 17e/16e/14/13/13 Pro, 2 Pack | 6.1 Inch, Tempered Glass, Anti Spy Private, Case Friendly, Not for iPhone 16 6.1 Inch
  • [2 Pack] This product includes 2 pack privacy screen protectors.WORKS FOR iPhone 17e/16e/14/iPhone 13/13 Pro 6.1 Inch tempered glass screen protector.Featuring maximum protection from scratches, scrapes, and bumps.[Not for iPhone 16 6.1 inch, iPhone 13 mini 5.4 inch, iPhone 13 Pro Max/iPhone 14 Pro Max/iPhone 14 Plus 6.7 inch, iPhone 14 Pro 6.1 inch]
  • Specialty: to enhance compatibility with most cases, the Tempered glass does not cover the entire screen. HD ultra-clear rounded glass for iPhone 17e/16e/14/iPhone 13/13 Pro is 99.99% touch-screen accurate.
  • 99.99% High-definition clear hydrophobic and oleophobic screen coating protects against sweat and oil residue from fingerprints.
  • High Privacy: Keeps your personal, private, and sensitive information hidden from strangers,screen is only visible to persons directly in front of screen.Good choose when you are in the bus,elevator,metro or other public occasions.(Note: Due to this privacy cover will darken the image to prevent the peeking eyes near you, you might need to turn your device display brightness up a bit when use it.)
  • Online video installation instruction: Easiest Installation - removing dust and aligning it properly before actual installation,enjoy your screen as if it wasn't there.

Citizen Lab also found Discover-Tech advertising on networks associated with defense ministries, armed forces, national cyber agencies, NATO, intergovernmental bodies, critical infrastructure and media organizations. Those impressions demonstrate that sensitive networks were exposed to the pipeline. They do not, by themselves, prove that those networks or their phones were compromised.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Why the investigation links the Al Jazeera attacks to Candiru

Citizen Lab combined several technical indicators rather than treating an ad appearance as proof. Its attribution is based on the timing of network logs, Discover-Tech infrastructure, a recovered Windows DLL, matching command-and-control servers and code similarities to Candiru’s earlier attack chain. The report rates the Candiru connection as high confidence.

Rank #3
JETech Privacy Screen Protector for iPhone 13/13 Pro, 2-Pack
  • [Compatibility] Specially designed for iPhone 13 / 13 Pro 6.1-inch. NOTE: Not for iPhone 17 / iPhone 16. Perfectly fits your screen and offers great protection to your iPhone
  • [Privacy Protection] Screen is only visible to person directly in front of screen. Protects your personal privacy effectively and ensures comfortable viewing experience
  • [Superior Quality] Made of premium ultra-thin (0.33mm) tempered glass, Resists scratches up to 9H
  • [Great User Experience] Dust-free, fingerprint-free, bubble-free, and easy to install
  • [Perfect Service] Package includes: Tempered Glass Screen Protector*2, cleaning kit, instructions

Candiru is also known as Saito Tech and has publicly rebranded as Integrity Labs. Earlier Citizen Lab work identified more than 750 websites connected to Candiru infrastructure and documented Microsoft-observed victims in Palestine, Israel, Iran, Lebanon, Yemen, Spain, the United Kingdom, Turkey, Armenia and Singapore.

Were Al Jazeera journalists targeted?

Yes. The current investigation identifies at least 45 Al Jazeera devices targeted during 2024 and 2025. That is a device count, not necessarily a count of individual journalists, and it is far smaller than the number of devices profiled during reconnaissance.

Rank #4
NEW'C for iPhone 16/15 Privacy Screen Protector Installation Tool Included | 3 Pack, only for iPhone 16/15 6.1", not compatible with iPhone 16 Plus/16 Pro/16 Pro Max/15 Plus/15 Pro/15 Pro Max
  • PRECISE COMPATIBILITY: Designed exclusively for iPhone 16 6.1" and iPhone 15 6.1". Not compatible with iPhone 15 Pro, 15 Plus, 15 Pro Max, iPhone 16 Pro, 16 Plus or 16 Pro Max. Please check the exact model of your smartphone before purchase. European/global model: A3287.
  • 28° PRIVACY ANTI-SPY FILTER: The privacy filter limits side-angle screen visibility. When viewed directly from the front, the content remains visible, while from the side the screen gradually appears darker, helping to protect your personal information.
  • 3 TEMPERED GLASS PROTECTORS + INSTALLATION KIT: The pack includes 3 tempered glass screen protectors and a handy installation tool to ensure the protector is positioned correctly on the screen.
  • 9H TEMPERED GLASS: Made from durable 9H-hardness tempered glass, it helps protect the screen against everyday scratches and impacts. The oleophobic coating reduces fingerprints, smudges, and residue, making the screen easier to clean.
  • CASE-FRIENDLY DESIGN: The protector is designed with a small margin around the screen edges to ensure compatibility with most cases. This is not a sizing error; the gap prevents the case from lifting the tempered glass.

This is not the first spyware campaign involving the network. Citizen Lab previously documented 36 Al Jazeera phones hacked with Pegasus in 2020. Pegasus is made by Israel-based NSO Group, while Candiru/Integrity Labs is a separate Israeli mercenary-spyware vendor.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

AdFection compared with Pegasus and earlier Candiru activity

Case Delivery path Interaction required Evidence described Scale denominator Geography or victims
AdFection, 2024–2025 Targeted online advertisements in websites and apps Zero-click for a selected target Network-log timing, Discover-Tech infrastructure, a recovered Windows DLL, command-and-control matches and code similarities Millions likely profiled; at least 45 Al Jazeera devices targeted; no worldwide confirmed-infection total Dozens of countries; Al Jazeera devices
Pegasus Project, historical reporting Message or app-based exploit campaigns Varied by exploit; a leaked selection list is not an infection record About 50,000 phone numbers selected as potential targets, with forensic confirmation on particular phones About 50,000 potential targets, not 50,000 infections Global investigation involving more than 80 journalists from 17 media organizations
Earlier Candiru activity Web infrastructure and exploit chains Varied by campaign More than 750 linked websites and Microsoft-observed victim activity Victim count not stated in the cited findings Palestine, Israel, Iran, Lebanon, Yemen, Spain, the United Kingdom, Turkey, Armenia and Singapore
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Does seeing a suspicious ad mean a phone is infected?

No. An impression can indicate that a device was reachable by the advertising infrastructure, but it cannot establish selection, exploitation or successful spyware installation. Citizen Lab’s findings require technical evidence to move from exposure to attribution and infection.

Best Value
SMARTDEVIL 2 Pack Privacy Screen Protector for iPhone 17 Pro Max, Anti-Spy | Military-Grade Shatterproof Protection, Tempered Glass Film , 9H Hardness, Fast & Easy Installation, Case Friendly Design
  • Perfect Fit for iPhone 17 Pro Max:Engineered exclusively for iPhone 17 Pro Max with seamless edge-to-edge coverage, ensuring precise alignment and reliable full-screen protection.
  • Advanced Privacy Protection:Features a 28° privacy filter with smooth 2.5D curved edges, preventing side glances in public. Your screen remains visible only to you—ideal for commuting, traveling, and crowded environments.
  • Effortless Installation:Equipped with an auto dust-elimination tool that delivers a fast, accurate, and bubble-free application, keeping your screen perfectly clear with minimal effort.
  • Military-Grade Protection:Made of nano-reinforced 9H tempered glass, SGS certified. Provides 5X stronger scratch resistance and proven durability, withstanding thousands of pressure and impact tests.
  • Smudge & Fingerprint Resistant:Hydrophobic and oleophobic coating repels fingerprints, sweat, and oil—ensuring your screen stays clean, clear, and smooth to the touch.

Likewise, an impression on a government, military or media network is a warning about systemic exposure, not proof that every device on that network was hacked. The report does not claim that every ad was malicious or that every person who saw one became a target.

What people at elevated risk should do

  • Keep the phone’s operating system, browser and major apps on their latest security releases.
  • If you may be a journalist, activist, diplomat or official targeted by spyware, contact an independent digital-rights organization or specialist mobile-forensics provider. Preserve the phone and relevant network records rather than resetting it before advice is obtained.
  • Do not treat an ordinary antivirus app or ad blocker as a proven defense against the zero-click techniques described here; the cited investigation does not establish that they can detect or stop them.
  • A Faraday pouch or other signal-blocking case can reduce wireless communication while the phone is inside it, but the findings do not establish that such a product prevents Pegasus, Candiru or ad-delivered zero-click exploits.

What remains unknown

Citizen Lab has not published a global number of confirmed infections caused by AdFection. It also has not said that every device in the millions-wide profiling estimate was a phone, that every impression reached a target, or that every targeted exploit succeeded. The strongest supported conclusion is narrower and more consequential: commercial advertising infrastructure can be used to identify large populations and silently deliver mercenary spyware to a much smaller set of selected devices.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Al JazeeraCandiruCitizen LabIntegrity Labsmobile securityspywarezero-click exploits

Leave a Reply

Your email address will not be published. Required fields are marked *

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Recommended PC Tool
Recommended PC Tool
Outdated Drivers Are Slowing You DownFree scan - exact matches
Windows Errors? Fix Them Before They SpreadFree repair scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.