Zero-Click Candiru Spyware Delivered via Online Ads at Al Jazeera
Citizen Lab researchers uncovered that Candiru's spyware infected Al Jazeera devices through auto-loading online ads. The attack required no user interaction, highlighting critical web security risks.
TL;DR
- Candiru spyware infected Al Jazeera devices using zero-click attacks via online ads.
- Malicious ads executed code automatically when loaded, even in the background.
- No user interaction was needed, making detection and prevention harder.
- Citizen Lab traced the infections back to targeted advertising networks.
- Organizations should audit ad vendors and implement stricter content filtering.
Security researchers at Citizen Lab have identified a sophisticated cyberattack targeting Al Jazeera, where devices were compromised through online advertisements without any user interaction. The spyware, developed by Israeli firm Candiru, exploited a zero-click delivery method, executing malicious code the moment ads loaded on users' screens—even when those ads were hidden from view.
This discovery underscores a growing threat vector in web security: the exploitation of digital advertising ecosystems to deliver stealthy, persistent surveillance tools. Unlike traditional phishing methods, these attacks bypass human error entirely, relying instead on vulnerabilities in how browsers and ad content interact.
How the Attack Worked
- The spyware was delivered through third-party online ads that automatically executed code upon loading.
- Some ads triggered infections without being visible to the user, running scripts in the background.
- No clicks or user actions were required, classifying the campaign as a 'zero-click' attack.
- The ads leveraged vulnerabilities in browser rendering engines to deploy malware silently.
Implications for Web Security
- Organizations can no longer rely solely on user awareness to prevent such advanced threats.
- Ad networks and real-time bidding systems present new surfaces for state-sponsored espionage.
- Defensive strategies must now include strict filtering and sandboxing of external ad content.
- Browser-level protections and Content Security Policies (CSP) are more critical than ever.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.