Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads
Candiru spyware infected Al Jazeera devices via zero-click ads.
Run Candiru?
Get an email when a reviewed story names Candiru, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Citizen Lab has identified that the Israeli spyware vendor Candiru used zero-click exploits delivered through online advertisements to infect devices at the Al Jazeera news network. These sophisticated attacks required no user interaction, with the malicious code executing as soon as an ad loaded, sometimes even in the background and out of sight.
The lesson from this incident
Full lessonCitizen Lab discovered that Candiru, an Israeli commercial spyware vendor, weaponized online advertisements to deliver zero-click exploits against Al Jazeera journalists — no user interaction was required for infection. This attack vector is particularly dangerous because traditional security awareness training is ineffective when the user does not need to click or engage with malicious content. The use of ad networks as a delivery mechanism highlights the risks of unvetted third-party content executing in privileged browser contexts. Organizations housing high-value targets such as journalists must treat the browser attack surface as a critical threat vector requiring active hardening and monitoring.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.