Zero-click attacks used targeted ads to deliver Candiru spyware
BLUF
Targeted advertising can be weaponized to deliver sophisticated spyware without any user interaction.
NEWS
Researchers reported that Candiru spyware was delivered to devices at Al Jazeera Media Network via targeted online advertisements. The attack was zero-click, requiring only that the malicious ad render on the victim's device. This shows how ad networks and browser-based delivery paths can be abused for high-end surveillance malware.
Why I Care
The incident affects journalists, media organizations, and other high-risk users who may be targeted through ordinary web browsing. Because no clicks or downloads are needed, traditional user awareness controls provide limited protection. It also highlights the broader risk that advertising infrastructure can become a supply-chain attack vector.
Next Steps
Media organizations should immediately patch browsers, operating systems, and rendering engines on high-risk devices within 24 hours. Security teams should deploy enterprise ad-blocking or web filtering controls and monitor for exploitation indicators tied to malicious ad campaigns. Journalists and sensitive users should use hardened browsers or isolated workstations for high-risk activity until protections are verified.
Source: BleepingComputer ·