The Malicious Ad That Installed Spyware With Zero Clicks

Robert Moore · 2026-10-16

You know that moment when a shady ad pops up and you think, "I'll just close it"? For a handful of journalists at Al Jazeera, simply letting that ad load was enough. No click, no tap, no download prompt. The Candiru spyware slipped onto their devices the moment the advertisement rendered on screen. That's the part that should make anyone sit up straight. We've spent years teaching people not to click suspicious links. Turns out, in this attack, clicking was never the issue. ### What a zero-click attack actually means A zero-click attack is exactly what it sounds like. The victim does nothing. The device does everything. In this case, the delivery vehicle was a targeted online ad, and the payload was Candiru, a commercial spyware tool linked to the notorious Pegasus ecosystem. Here's the uncomfortable truth: rendering an ad isn't a user action. It's an automatic process. Your browser pulls in images, scripts, and tracking pixels whether you're paying attention or not. If one of those pieces is booby-trapped, the trap springs on its own. ### Why this changes how you think about browsing Most people assume safety lives in their habits. Don't click weird links. Don't open strange attachments. But zero-click delivery flips that logic on its head. The threat doesn't wait for your curiosity. It just needs your browser to do its job. - **Ads are code.** Every ad slot can load scripts, and scripts can be weaponized. - **Targeting is real.** Ad networks can deliver a specific creative to a specific person, which makes "targeted" attacks disturbingly precise. - **Reputation isn't enough.** A legitimate ad network can be abused without the victim ever visiting a sketchy site. As one security researcher put it, "The scariest exploits are the ones that don't ask for your permission." That line sticks because it's true. ### Where antidetect browsers fit in This is where tools like antidetect browsers start to look less like niche gadgets and more like practical armor. These browsers let you control and separate your digital fingerprints, so you're not one easily targeted profile sitting in a pool of data brokers and ad networks. A good antidetect browser helps you: - **Compartmentalize identities** so a single ad target doesn't map back to everything you do. - **Block or isolate third-party scripts** that render automatically. - **Reduce fingerprint leakage** that advertisers and attackers use to find you in the first place. If you're evaluating the best antidetect browser for your setup, look for real fingerprint control, clean profile isolation, and script management that doesn't fight you every time you open a tab. The goal isn't paranoia. It's giving yourself fewer automatic doors for spyware to walk through. ### The takeaway The Candiru campaign is a reminder that modern threats don't need your cooperation. They need your browser to render, your ad blocker to stay off, and your fingerprint to stay visible. Tighten those three things, and you've closed a door most people don't even know is open. Stay curious, but stay deliberate about what loads on your screen.