Citizen Lab ties Al Jazeera zero-click spyware infections to online ads

· Cybersecurity

Researchers at the Citizen Lab said the Israeli spyware vendor Candiru infected devices at the news network Al Jazeera through ordinary online ads, in attacks that required no click or other action from the user. The hidden attack code ran the moment an ad loaded on the screen, according to the findings. Candiru sells spyware to governments. The research is one of the clearest public cases of zero-click spyware spreading through the advertising supply chain, a channel that reaches users worldwide and is difficult for targets to avoid or detect.

Why it matters：It exposes ad delivery as a zero-click attack vector, raising hard questions for ad networks, publishers and anyone selling surveillance software.

Key points

  • No user action was needed; code ran when the ad loaded.
  • Candiru sells spyware to governments.
  • The finding was published by the Citizen Lab.

Sources (original reporting)

More stories from this day