Targeted online ads delivered zero-click spyware to news devices
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Friday, October 16th, 2026.
Ordinary browsing became an infection route when targeted online ads delivered spyware without requiring a click. Investigators linked attacks against Al Jazeera devices in 2024 and 2025 to advertising infrastructure and spyware associated with Candiru.
At least 45 devices were targeted. Exposed bidding records also showed the advertising platform operating across more than one hundred twenty thousand websites and seventy thousand mobile apps. That scale needs context: seeing one of the ads did not mean every device was infected.
Traditional phishing awareness cannot prevent an attack that requires no user action. Journalists, executives, government personnel, and other high-risk users may be particularly valuable targets. Leaders should treat advertising and third-party browser content as part of the attack surface for sensitive roles. Defenders should consider trusted ad blocking, tracking restrictions, browser isolation, and monitoring for unusual traffic generated when ads load.
The larger lesson is that trusted digital supply chains can quietly become delivery systems for surveillance. Block unnecessary advertising and tracking on sensitive devices, and investigate unusual connections created when ads load.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
