GajShield Threat Advisory — Discover-Tech Ad Network Linked to Candiru Spyware

Severity: High | Priority: 1

Discover-Tech, an Israeli ad-tech company, ran ad delivery and profiling infrastructure used to deliver Candiru mercenary spyware without any user interaction. Discover-Tech had been an approved ad vendor with Google and IAB Europe. Each ad carried a small script that reported the device’s advertising ID and IP address to a Discover-Tech server, which decided whether that device was a target. Targeted devices received attack code; all others received nothing.

At least 45 Al Jazeera devices were targeted in 2024 and 2025. The same ads also reached ordinary networks at very large scale, including those of governments, international bodies, chipmakers and news organisations. Google, IAB Europe and several ad platforms cut off Discover-Tech in early October 2026.

An alert for these domains usually means a device on your network loaded an ad from this network. That alone does not mean the device was compromised.

First, identify the device and its user. If the source is your internal DNS server, use its query logs to find the actual client. For most users, block the domains and enable ad and tracker blocking on that device.

Escalate if the user is a likely spyware target: senior executives, journalists, legal or government-facing staff, or anyone who handles sensitive information. For those users, check the device for:

• unexpected processes or new persistence items
• outbound connections to unfamiliar hosts shortly after the alert
• the published Candiru sample, SHA-256 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8

If anything suspicious appears, isolate the device, preserve it for forensic analysis, and rebuild it rather than cleaning it. Then reset the user’s credentials from a separate device.

To reduce your exposure:

• Block advertising and tracking at your network gateway, which NSA and CISA have recommended since 2018.
• Disable personalised advertising and the mobile advertising ID on managed devices.
• Apply stricter browsing and app controls for staff who are likely targets.
• Keep browsers and mobile operating systems fully updated, because the initial exploit used against the targeted devices has not been identified.