An investigation by the University of Toronto-based Citizen Lab has identified that an Israeli advertising technology firm, Discover-Tech, played a role in deploying spyware onto dozens of devices used by staff. This discovery follows an internal review initiated by technology team, which identified suspicious network patterns on journalist devices beginning in 2024 and continuing through 2025. In-house technology team first discovered unusual patterns on devices used by some journalists in 2024. The pattern continued into 2025.
The malicious software is linked to Candiru, an Israeli spyware developer that has been blacklisted by the United States government since 2021 due to its involvement in harmful cyber activities. The Citizen Lab report, released Thursday, details how the spyware was delivered via the first-known instance of “zero-click” targeted advertising. This sophisticated technique is designed to bypass standard security defenses by using encrypted communication channels and breaking down stolen data into smaller, less detectable fragments. The spyware often uses encrypted communication channels and breaks up stolen data into smaller chunks sent over time, to avoid triggering security mechanisms.
The software, which is estimated to cost several million dollars, has historically been used to monitor at least 100 individuals, including dissidents and journalists across various nations. Analysis of the network logs provided by to Citizen Lab during the study provided a definitive temporal signature, allowing experts to verify and document the precise nature of the attacks.
In a formal statement, Media Network noted that it “condemns the targeting of devices belonging to several of its employees with spyware” and committed to continuing its efforts to “protect its employees and systems.” The network described the breach as an “assault on press freedom and the public’s right to knowledge,” and has called for those responsible for the digital surveillance campaign to face accountability.
The network further emphasized that its collaboration with investigators was essential in verifying the breach and bringing these tactics to public attention. The incident highlights the high level of sophistication now employed by firms such as Candiru and their clients, who are increasingly capable of bypassing modern security protocols to compromise the digital privacy of those reporting on sensitive global issues. The cooperation “contributed to verifying these attacks and publicly documenting them”.
