Candiru Spyware Reached Al Jazeera Devices by Riding Ordinary Web Ads, Citizen Lab Says
Candiru — an Israeli commercial spyware vendor whose products are sold to government clients — infected devices belonging to the news network Al Jazeera through ordinary online advertising, according to researchers at the Citizen Lab. The attacks, disclosed Thursday and covered by The Hacker News, were zero-click: no confirmation dialog, no lure, and no interaction of any kind was required from the target. The attack code executed the moment an ad rendered on the screen, and in some cases the ad loaded invisibly, in the background, where the user never saw it at all.
The research group behind the disclosure, based at the University of Toronto's Munk School, is well known to Hong Kong readers in particular. It has previously published investigations documenting surveillance activity affecting Hong Kong targets and Uyghur communities abroad, work that made it one of the most cited independent sources on commercial spyware in the region.
The last piece of friction is gone
Commercial spyware has been moving toward "zero-click" operation for years, most infamously through exploits delivered via messaging apps. The Candiru campaign described by Citizen Lab removes even the residual friction of a lure: with the payload delivered through the ad-rendering path, the victim's device fetched it through channels that security teams and users are trained to treat as normal background traffic.
That distinction matters more than it might appear. Messaging exploits are typically bespoke, priced per target, and dependent on the victim receiving a specific message. Advertising, by contrast, is a mass-distribution pipe. If spyware can ride the ad-rendering path, its operators inherit the reach, automation, and — critically — the deniability of the legitimate advertising ecosystem.
It also closes off the last line of defence most organisations still rely on: human caution. Awareness training can teach staff to distrust unexpected attachments or suspicious links. It cannot teach them to distrust a banner ad on a site they visit every day, or an impression served while a page loads in a background tab.
Who Candiru is
Candiru is one of several Israeli firms that have built a commercial business selling intrusion software to state clients. As public record independent of Thursday's report, the U.S. Commerce Department added the company to its Entity List in December 2021, alongside NSO Group and Cytrox, restricting its access to American technology over surveillance abuses linked to its products. That listing did not stop the company's tools from appearing in new incidents, and the Al Jazeera case suggests its operators have adapted their delivery tradecraft rather than retreated.
Why the delivery channel is the story
The novelty here is not the vendor but the pipe. Ad infrastructure is technically privileged — it runs scripts, executes code, and loads resources as a routine part of page rendering. It is opaque to end users, who cannot inspect which exchange or intermediary served a given impression. And it is enormous: any defence that depends on users recognising malicious content simply does not scale to the sheer volume of daily ad requests.
The practical implication is that responsibility shifts upstream. Ad exchanges, publishers, browsers, and mobile operating-system vendors are now the chokepoints where this class of attack can be stopped — through stricter validation of creative code, tighter sandboxing of rendering processes, and faster patching of browser flaws exploited in the wild.
Citizen Lab's report does not fully answer how widely the malvertising campaign was distributed before narrowing onto Al Jazeera targets, whether ad-exchange infrastructure was knowingly compromised or merely abused, or which governments ultimately received the exfiltrated data. Those questions remain open follow-ups as the story develops — and the compromised-versus-abused distinction in particular will determine where remediation responsibility ultimately sits.
A defence checklist for high-risk organisations
For Hong Kong newsrooms, NGOs, and enterprises handling sensitive material, the report undercuts a common assumption: "our people don't click strange links" is no longer an adequate threat model. Baseline hardening now includes:
- Deploy ad and script blocking — enforce blocking of third-party scripts and advertisements on managed devices, and treat allow-listing as a deliberate policy decision rather than a default. Note the trade-off: blocking extensions are themselves a supply-chain surface, and aggressive allow-listing can push staff toward unmanaged devices or shadow IT, so pair the policy with usable sanctioned alternatives.
- Isolate browsing — use browser isolation or hardened, separately managed profiles for staff who research unfamiliar or high-risk sources.
- Sanitise rendering — enable strict site isolation and ensure mobile operating systems and browsers are patched promptly for actively exploited flaws.
- Harden and monitor endpoints — deploy mobile device management with lockdown modes where available, and alert on anomalous background data flows that could indicate silent payload delivery.
- Rehearse incident response — assume ad-delivered compromise can occur without a user-reported trigger, and build detection playbooks around network and endpoint telemetry rather than user complaints.
Citizen Lab：Candiru 間諜軟件藉一般網絡廣告入侵半島電視台職員裝置
Citizen Lab 研究人員指出，以色列商業間諜軟件供應商 Candiru——其產品出售予政府客戶——透過一般網絡廣告，感染了新聞網絡半島電視台（Al Jazeera）職員的裝置。該批攻擊於周四披露，並由 The Hacker News 報道，屬「零點擊」攻擊：毋須確認對話框、毋須任何引誘內容，目標亦毋須作出任何互動。攻擊代碼在廣告於屏幕上顯示的一刻即已執行；部分情況下，廣告更以隱形方式於背景載入，用戶從頭到尾未嘗一見。
今次披露背後的研究機構隸屬多倫多大學蒙克全球事務與公共政策學院（Munk School），尤為香港讀者所熟悉。過往曾發表多份調查，記錄針對香港目標及海外維吾爾社群的監察活動，令其成為該地區商業間諜軟件最常被引用的獨立消息來源之一。
最後一道摩擦已消失
商業間諜軟件多年來一直趨向「零點擊」操作，最惡名昭彰者莫過於透過通訊應用程式傳送的漏洞利用程式（exploit）。Citizen Lab 所描述的 Candiru 行動，就連引誘目標這一點僅存的「摩擦」也一併消除：載荷（payload）改經廣告顯示流程傳送，受害裝置透過安全團隊及用戶均被訓練視為正常背景流量的渠道下載攻擊內容。
這項區別的重要性遠超表面所見。通訊應用程式的漏洞利用通常度身訂造、按目標逐一訂價，並有賴受害者接收特定訊息。相反，廣告是大眾化分銷渠道。若間諜軟件能搭上廣告顯示流程，其操控者便同時承繼了合法廣告生態系統的覆蓋範圍、自動化能力，以及——關鍵在於——否認能力。
這亦封閉了多數機構仍然依賴的最後一道防線：人為警覺。意識培訓可以教導員工不信任意外附件或可疑連結，卻無法教導他們不信任自己每日到訪網站上的橫額廣告，亦無法教導他們不信任網頁於背景分頁載入期間送出的任何一次廣告展示（impression）。
Candiru 是何方神聖
Candiru 是數家向國家客戶出售入侵軟件的以色列公司之一。與周四報告無關的公開紀錄顯示，美國商務部早於 2021 年 12 月，已將該公司與 NSO Group、Cytrox 一同列入實體清單（Entity List），因其產品涉及監察濫用而限制其取得美國技術。此項列入並未阻止該公司工具再次出現在新一輪事件中；半島電視台一案顯示，其操控者是改良了投放手法，而非就此退卻。
為何投放渠道才是焦點所在
今次的創新之處不在供應商，而在渠道。廣告基建在技術上享有特權——它執行腳本、運行代碼、載入資源，均屬網頁顯示的例行操作。對最終用戶而言，它並不透明，用戶無法查閱究竟哪個廣告交易所或中介方送出某次廣告展示。其規模更極為龐大：任何依賴用戶辨識惡意內容的防禦措施，面對每日天文數字般的廣告請求，根本無法擴展奏效。
實際影響在於責任向上游轉移。廣告交易所、出版商、瀏覽器及流動作業系統供應商，如今正是可以遏止此類攻擊的瓶頸所在——方法包括更嚴格驗證廣告創意代碼、更嚴密地以沙箱（sandbox）隔離顯示流程，以及更快修補正遭實際利用的瀏覽器漏洞。
Citizen Lab 報告未有完全解答若干問題：惡意廣告行動在收窄至半島電視台目標之前分銷範圍有多廣泛、廣告交易所基建是知情被入侵抑或僅遭濫用，以及最終哪些政府接收了被外洩的數據。上述問題將隨事件發展持續跟進——其中「被入侵」與「遭濫用」的區別，尤其將決定補救責任最終歸屬何方。
高風險機構的防禦清單
對香港新聞編輯室、非政府組織及處理敏感資料的企業而言，此報告動搖了一項常見假設：「員工不會點擊奇怪連結」已不再是一個夠用的威脅模型。現時基本防護加固措施包括：
- 部署廣告及腳本攔截——在受管理裝置上強制攔截第三方腳本及廣告，並把加入允許清單（allow-list）視為一項刻意的政策決定，而非預設設定。注意當中取捨：攔截擴充功能本身已構成一項供應鏈攻擊面，而過度嚴格的允許清單可能迫使員工轉用不受管理裝置或影子 IT（shadow IT），故政策須配合實用且獲認可的替代方案一併推行。
- 隔離瀏覽環境——為需要查閱陌生或高風險來源的員工，使用瀏覽器隔離（browser isolation）或加強保安、獨立管理的用戶設定檔。
- 淨化顯示流程——啟用嚴格的網站隔離功能，並確保流動作業系統及瀏覽器及時修補正遭實際利用的漏洞。
- 加固及監察終端裝置——部署流動裝置管理（MDM），在可行情況下啟用鎖定模式，並對可能顯示載荷靜默投放的異常背景數據流動發出警報。
- 演練事故應變——假設廣告投放型入侵可在沒有用戶舉報觸發的情況下發生，並以網絡及終端裝置遙測數據（而非用戶投訴）為基礎建立偵測流程手冊。