Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads
Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that needed no click or other action from the user, researchers at the Citizen Lab said Thursday. The hidden attack code ran the moment an ad loaded on the screen, and in some cases the ad loaded out of sight, in the background. The Citizen
Candiru, an Israeli spyware company, infected Al Jazeera news network devices through seemingly innocuous online ads, according to researchers at Citizen Lab. This covert attack required no user action and marked the first public confirmation of mercenary spyware infiltrating devices via targeted ads. The attack code activated the moment an ad loaded, sometimes hidden in the background.
The Citizen Lab, based at the University of Toronto, found the first step of the attack, which involved Discover-Tech, an Israeli advertising firm, placing the ads. Each ad transmitted the device's advertising ID and internet address back to a Discover-Tech server, which then determined if the device belonged to a target. If so, the server transmitted attack code for the browser or app to run.
At Al Jazeera alone, 45 devices were targeted in 2024 and 2025, with activities linked to Candiru with high confidence. The researchers were unable to retrieve the initial exploit that infiltrated the browser or app. Discover-Tech, linked to Candiru, placed ads on nearly four billion ads between March and June 2026, appearing in about 75,000 apps and 120,000 websites.
This system could potentially reach sensitive networks, though not all users were necessarily infected.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
