A new report from Citizen Lab researchers shows how spyware companies can hack anyone viewing an online advertisement.

Two Israeli companies carried out a surveillance operation on Al Jazeera journalists via an unprecedented form of cyberattack, according to a report out Thursday. They used ads hosted by Google and other tech giants to deliver malware onto the targets’ devices.

In practice, the research shows how surveillance businesses can hack anyone viewing an online ad, says Wolfie Christl, one of the authors of the report.

“It’s difficult, if not almost impossible, to consistently protect yourself from malicious ads,” Wolfie tells Forbes. “Ad blocking must now be considered a cybersecurity best practice.”

Core to the attacks is a Tel Aviv-based company called Discover-Tech. It provides a legitimate service to advertisers, offering to find the best places to serve their ads and then bidding for the relevant ad space on Google, Microsoft and Yandex, among others.

But the company offers a service called Controlium, which allows a spyware company to select a target from the data Discover-Tech gathers from its advertising partners, Citizen Lab claims. Then, the service can send a malicious ad to a website or app, which then would compromise the target’s computer, according to the researchers.

That’s what they claim an Israeli company called Candiru did. Across 2024 and 2025, the firm used Discover-Tech to serve malware-laced ads to as many as 45 Windows computers owned by Al Jazeera employees, Citizen Lab reported. Candiru was acquired by a small U.S.-based private equity company Integrity Partners in early 2025. Discover-Tech and Candiru did not respond to a comment request.

Candiru has been linked to surveillance of journalists before, including an attack on London-based news site Middle East Eye in 2021. Its malware is capable of spying on messages, calls and locations of infected devices. Candiru has previously told Forbes it did not know how its customers used its malware.

It is unclear what the spyware did on the Al Jazeera computers. The media company hadn’t commented at the time of publication.

The researchers were unable to identify a motivation behind the attacks or name any Candiru customer behind the surveillance op. It “seems highly likely” that some governments are abusing surveillance capabilities “to target individuals outside of strictly criminal or national security purposes,” the researchers wrote in their report.

Citizen Lab said it disclosed the issues to Google, which banned Discover-Tech from its ads platform. Google told Forbes it also set up warnings for users of its Safe Browsing app in Chrome, telling them if they are trying to visit a website linked to the group. A company spokesperson also pointed Forbes to a linked investigation by ad security firm Confiant, which found signs that the same malicious ads were displayed on networks of major governmental entities, including the U.S. Department of Defense, as well as nuclear research entities, though it’s unclear if there was any security threat as a result.

Forbes has previously reported on the Israeli surveillance industry’s compromise of the advertising industry. One tactic is for a spyware company to set up what’s known as a Demand-Side Platform (DSP), which acts as a middleman between apps, websites and advertisers. That enables them to surreptitiously collect location and identifying information. According to Citizen Lab, that tactic has also been adopted by Discover-Tech.

Citizen Lab said it also detected potentially malicious ads targeting journalists at as many as 18 other news agencies in countries like Israel, France, Italy, Australia and Mexico. The researchers are now contacting those media organizations to see how badly they were hit.