Spyware Hits Al Jazeera via Online Ads—No Click Needed

Emily Davis · 2026-10-15

Imagine you're just scrolling through a news site, reading an article, and suddenly—without clicking anything—your device gets infected with spyware. That's exactly what happened to journalists at Al Jazeera, according to a bombshell report from Citizen Lab released Thursday. The culprit? Candiru, an Israeli spyware maker that sells its tools to governments. And the attack vector? Ordinary online ads. No phishing emails, no malicious links, no downloads. Just ads loading on a page. ### How Zero-Click Attacks Work Zero-click attacks are the stuff of cybersecurity nightmares. They exploit vulnerabilities in your device or browser that require zero interaction from you. In this case, the malicious code was hidden inside ad banners. The moment the ad loaded—even if it was off-screen in the background—the spyware installed itself. "The hidden attack code ran the moment an ad loaded on the screen, and in some cases the ad loaded out of sight, in the background," Citizen Lab reported. That means you don't even have to see the ad to be compromised. Just visiting a page that serves the ad is enough. ### Why This Matters for Everyone You might think, "I'm not a journalist or a government target. Why should I care?" But this attack method lowers the bar for cybercriminals. If ad networks can be hijacked to deliver spyware, any website that displays ads—which is most of the internet—could become a delivery vehicle. And it's not just about spyware. The same technique could be used to steal passwords, financial data, or corporate secrets. The line between targeted espionage and mass cybercrime is getting thinner. > "The industrialization of spyware has made advanced attack tools available to anyone with a checkbook," said a security researcher familiar with the case. ### Protecting Yourself in a Zero-Click World So what can you do? While zero-click attacks are scary, they're not invincible. Here are some practical steps: - **Keep your devices updated.** Software patches often fix the vulnerabilities these attacks exploit. - **Use a reputable ad blocker.** Blocking ads reduces your exposure to malicious ad networks. - **Consider an antidetect browser.** Tools like antidetect browsers can mask your digital fingerprint, making it harder for attackers to target you specifically. - **Be cautious with public Wi-Fi.** Unsecured networks can be a playground for man-in-the-middle attacks. ### The Bigger Picture This isn't the first time Candiru has been in the headlines. The company has been linked to attacks on journalists, activists, and dissidents worldwide. What's new here is the delivery method: exploiting the ad ecosystem that powers so much of the web. It's a sobering reminder that our digital lives are more fragile than we'd like to think. But awareness is the first step. By understanding how these attacks work, we can better defend ourselves—and demand that tech companies and governments do more to protect us. Stay safe out there.