Zero-Click Candiru Spyware Delivered via Targeted Online Ads to Al Jazeera Journalists

Spyware Delivered Through Online Ads

Researchers at Citizen Lab, a group at the University of Toronto, have confirmed that Candiru spyware infected devices at the news network Al Jazeera. The infections occurred through ordinary online advertisements, in attacks that required no click or other action from the user. The hidden attack code executed the moment an ad loaded on the screen, sometimes in the background out of sight.

First Public Confirmation of Method

This incident represents the first public, technical confirmation that mercenary spyware, which are hacking tools sold to governments, has reached real devices through targeted ads. While this method had been described in leaked company documents previously, it had not been demonstrated in a live attack until now. The attacks were effective on both iOS and Android devices.

Attack Details and Scope

The malicious ads were placed by Discover-Tech, an Israeli company presenting itself as a digital advertising firm. Each ad contained a small piece of code that, upon loading, quietly sent the device's advertising ID and internet address. Citizen Lab confirmed that this campaign, named AdFection, infected at least 45 devices belonging to journalists at Al Jazeera. The malicious infrastructure also served ads onto the internal networks of dozens of government agencies and international organizations, including NATO, the U.S. Department of Defense, Estonia’s Information System Authority (RIA), and the International Atomic Energy Agency (IAEA).

Technical Findings

Researchers recovered the spyware itself from one device, but not the exploit that initially breaks into the browser or app to install it. The initial break-in step was described based on how the attack was configured, rather than from captured code. The investigation was conducted in parallel by Citizen Lab and the ad tech-focused cybersecurity company Confiant.

Implications for News Organizations

Citizen Lab researchers stated that this investigation serves as a warning to news organizations globally, indicating they may be actively targeted via this new threat vector. Such targeting could occur within newsrooms or against individual journalists, editors, and other staff members.