Security researchers at Citizen Lab say devices at Al Jazeera were infected with Candiru spyware through ordinary online advertisements in a zero-click attack, meaning users did not need to click an ad or take any action for malicious code to run. According to the report cited by The Hacker News, the attack code executed when an ad loaded, and in some cases the ad appeared to load in the background rather than visibly on screen.

While the reported victims were in a media organisation and the spyware vendor is associated with government customers, the broader lesson for businesses is that web advertising infrastructure and third-party content can create a security exposure on employee devices, even during routine browsing.

What happened

Citizen Lab traced spyware infections to ads delivered through the online advertising ecosystem. The key concern is the delivery method: a standard ad placement allegedly became the vehicle for hidden attack code, allowing spyware to run without a user clicking a link, downloading a file or opening an attachment.

Based on the source material, Citizen Lab attributes the infections to Candiru, an Israeli spyware company known for selling surveillance tools to government clients. The report focuses on targeted attacks against Al Jazeera devices. The source does not suggest this was a broad consumer malware campaign, but it does show that ad delivery paths can be abused in highly sophisticated operations.

Why it matters for European businesses

For European companies, the immediate relevance is not the specific victim but the attack path. Many businesses rely on browsers, ad-supported websites, embedded third-party content and cloud-based work environments every day. If malicious code can execute simply because an ad is loaded, then standard user awareness advice such as “do not click suspicious links” is not always enough.

This matters especially for organisations that:

• allow broad web access from corporate devices
• depend on media buying, ad verification, affiliate tools or advertising dashboards
• use unmanaged or lightly managed employee devices
• handle sensitive commercial data, confidential communications or regulated information
• operate in sectors likely to face targeted surveillance, including media, legal, public affairs, defence-adjacent industries and some cross-border commercial operations

The case also reinforces a wider cybersecurity point for SMEs: third-party web content is part of the attack surface. Even when a company is not running ads itself, employees may still be exposed through websites they visit for work.

Who may be affected

The most direct risk is to organisations that could plausibly be targeted for espionage or intelligence gathering. That includes newsrooms, NGOs and political groups, but also companies involved in high-value negotiations, intellectual property, strategic supply chains or sensitive regional markets.

However, the operational lessons apply more broadly to:

• SMEs and founders whose teams use standard browsers on laptops and mobile devices for everyday business tasks
• IT and security teams responsible for browser security, endpoint protection and monitoring of unusual device behaviour
• Marketing and e-commerce teams that work extensively with ad platforms, tracking tools and third-party scripts
• Regulated businesses that must show appropriate security controls around devices and data access

What companies should consider

European businesses do not need to assume they face the same level of targeting as a major broadcaster to take useful action. The practical response is to treat browsers, mobile devices and third-party web content as security priorities.

• Review browser and device patching: Ensure operating systems, browsers and mobile devices are updated quickly, because zero-click and browser-based attacks often rely on unpatched weaknesses.
• Strengthen endpoint detection: Check whether existing endpoint protection can detect suspicious browser activity, exploit behaviour or spyware-like persistence.
• Reduce unnecessary exposure: Consider tighter controls for high-risk users such as executives, journalists, legal teams or staff handling sensitive negotiations.
• Segment sensitive workflows: Where practical, separate high-sensitivity work from general web browsing and personal-use activity on the same device.
• Audit third-party web dependencies: For company-owned sites and applications, review ad-tech, embedded scripts and external content relationships to minimise avoidable supply-chain exposure.
• Prepare incident response for mobile and browser compromise: Traditional phishing playbooks may not be enough if an attack leaves little or no user-visible trace.
• Reassess user training: Security awareness remains important, but organisations should not rely on click-avoidance alone when some attacks require no user action.

The reported campaign appears to be a targeted spyware operation rather than a routine criminal malware outbreak. Even so, the case is a useful warning for European businesses: security risk can enter through normal web activity, including ad delivery systems that users never actively engage with.