Gov Spyware Infects 45 Al Jazeera PCs via Ads in First Zero-Click Ad Campaign

Researchers at the Citizen Lab have confirmed that mercenary spyware can infect devices through online advertisements without requiring any user interaction. According to a report by TechCrunch, this method allows attackers to bypass traditional security measures that rely on users clicking malicious links.

How did the attack work?

The Citizen Lab identified that the Israeli firm Discover-Tech served as the delivery mechanism. The company presents itself as a legitimate advertising vendor but facilitated the distribution of spyware from Candiru and Bindecy. According to The Hacker News, the ads contained code that sent device identifiers to a server. If the device matched a target list, the server returned exploit code. Otherwise, it sent nothing, allowing the ads to pass standard network filters.

Which organizations are affected?

The researchers focused on attacks against the media organization Al Jazeera. They found that at least 45 Windows computers were compromised in 2024 and 2025. The Citizen Lab linked these infections to Candiru spyware with high confidence. The group noted that this is the first technical confirmation that such spyware has reached real devices through targeted ads, moving beyond theoretical risks described in leaked documents.

What is the threat landscape?

This event marks a shift in how state-aligned actors deploy surveillance tools. Previously, malvertising was known, but using it for zero-click government spyware is a new escalation. The Citizen Lab stated it is unclear which governments sponsored the attacks. However, the ability to target specific individuals or devices globally through ad networks significantly expands the attack surface for high-value targets.

Questions to ask your suppliers

Security teams should review how third-party advertising partners vet their content delivery networks. Ask whether your vendors monitor for unusual data exfiltration patterns from ad pixels. Determine if your organization allows unvetted ad scripts to run in production environments. Inform your legal and compliance departments about the potential for supply chain compromises via advertising partners. Ensure that network monitoring tools can detect connections to unknown command-and-control servers initiated by web browsers.

Background: Attack surface

Attack surface analysis is the process of identifying every digital interface where an attacker might interact with your systems. It goes beyond traditional vulnerability scanning to map external-facing assets, shadow IT, and exposed APIs. This method helps you prioritize risks by understanding how these interfaces connect to critical data.

Read the full guide: Attack Surface Analysis: Map Hidden Entry Points Before Exploitation

What to do and how to stay safe: Candiru

• Review browser logs for connections to unknown advertising servers that occur before page content loads.
• Restrict the ability of web browsers to execute scripts from untrusted advertising domains.
• Monitor for outbound traffic from endpoints to IP addresses associated with known mercenary spyware infrastructure.
• Implement strict allow-listing for software installations to prevent unauthorized executables from running.

Step-by-step guide: Stop Malvertising Attacks Before They Load

General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is a patch available for this vulnerability?

No fix has been confirmed yet for the specific exploit used in this attack.

Which spyware was used in the Al Jazeera attacks?

The Citizen Lab linked the infections to Candiru spyware.

Did users have to click on the ads to get infected?

No, the attacks were zero-click and required no user interaction.