Al Jazeera Media Network confirmed Thursday that spyware had been placed on devices used by dozens of its staff members and personnel at other organizations. The network stated it condemns the attacks and characterized the targeting of journalists as an assault on press freedom, calling for accountability from those responsible.
According to an investigation by Citizen Lab, a research unit at the University of Toronto, the spyware originated from Candiru, an Israeli cybersecurity firm that the United States blacklisted in 2021 for malicious cyber activities. The attack represented the first documented instance of spyware being deployed through infected targeted advertisements, which Discover-Tech, an Israeli advertising technology company, purchased and distributed. Once an infected advertisement loaded on a device, it automatically infected that device with malware capable of extensive data collection.
The spyware is engineered to gather sensitive information including files, documents, browser data such as cookies and credentials, keystrokes, screenshots, and audio and video from microphone and webcam functions. It can also extract emails and messages from communication platforms. To evade detection, the malicious software employs encrypted channels and fragments stolen data into smaller pieces sent incrementally over time. Experts estimate the particular tool used cost several million dollars.
Al Jazeera’s technology team initially detected suspicious activity on journalist devices in 2024, with the pattern continuing into 2025. The network then engaged Citizen Lab to conduct a comprehensive analysis of the attacks. According to Citizen Lab’s report published Thursday, network logs collected during the attack period provided clear evidence of how the compromise was executed.
Separately, Confiant, a New York-based advertising security firm, reported that advertisements from Discover-Tech also appeared in networks used by the Pentagon, the United Nations International Atomic Energy Agency, and the International Criminal Court. Prior investigations have documented Candiru’s spyware being used in surveillance operations targeting at least 100 journalists, dissidents, and other individuals across multiple countries.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI