The University of Toronto researchers say it is the first public technical proof of so-called zero-click spyware arriving through ads, in which victims did not have to tap or click anything.
The report ties at least 45 Al Jazeera devices, targeted in 2024 and 2025, to Candiru. Citizen Lab first exposed the Israeli spyware maker, now known as Integrity Labs, in 2021, the same year the US blacklisted it.
The ads themselves came from Discover-Tech, an Israeli company that presents itself as an advertising firm. In practice, Citizen Lab says, it acts as a go-between for several spyware vendors, Candiru among them.
The method relies on real-time bidding, the split-second auctions that decide which ad a person sees when a page or app loads.
Each time a Discover-Tech ad appeared, a script checked the device’s ad ID and IP address. A device on the target list received code that started the attack, while every other device got back nothing at all.
That meant nobody had to click, and also meant the ad companies serving the ads never saw the harmful code.
thenextweb.com
) here: 
