Citizen Lab Identifies Zero-Click Candiru Spyware Infections at Al Jazeera via Malicious Online Ads

According to a report published by The Hacker News, Citizen Lab researchers identified infections at Al Jazeera linked to Candiru, a company that sells spyware to government clients. The attack vector leveraged zero-click exploitation of iOS devices through maliciously crafted online advertisements. The hidden attack code ran the moment an ad loaded onto the screen, and in some instances the ad loaded in the background without being visible to the user. No click or other user interaction was required for the exploit to trigger. The infections compromised devices at a major international news organization, raising concerns about the potential exposure of journalistic sources and sensitive data. The report highlights that the advertising ecosystem serving ads to Al Jazeera was instrumental in delivering the malicious payloads. While the specific ad networks involved have not been named, the findings underscore the risk posed by zero-click delivery methods that exploit trusted web infrastructure. Citizen Lab and Apple are likely working on mitigations, and general recommendations include keeping iOS devices updated and using ad-blocking tools.