Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads

This is a textbook zero-click watering hole attack via ad injection. The operational security (OpSec) failure here is significant—Candiru’s infrastructure was exposed by the ad network logs.

Technical Breakdown: – TTPs: – Initial Access (T1189): Drive-by compromise via malicious ad creatives (malvertising). – Execution (T1203): Zero-click exploit chain. No user interaction required; payload executes on ad render. – Resource Development (T1587.001): Candiru developed the zero-day exploits used in the ad tags. – IOCs: – Domains: Ad servers and redirect chains identified by Citizen Lab (specific domains redacted in public report but shared with Al Jazeera). – Payloads: Candiru’s proprietary malware (no public hashes available, but signature-based detections are likely ineffective). – Affected: Al Jazeera employees and potentially visitors to the network’s domains.

Defense: – Network: Block known malvertising domains and implement DNS filtering for ad networks not on an allowlist. – Endpoint: Deploy behavior-based EDR (look for mshta.exe, wscript.exe, or regsvr32.exe spawning from browser processes). Disable unnecessary scripting engines in the browser. – User: No user training can fix a zero-click. This is a supply chain and infrastructure problem.

Source: https://thehackernews.com/2026/10/citizen-lab-traces-zero-click-candiru.html