Candiru spyware delivered via zero-click targeted malvertising

Researchers have revealed that the notorious Candiru spyware was deployed against Al Jazeera personnel using a zero-click exploit delivered via targeted online advertisements. Simply rendering the malicious ad on the victim’s device was sufficient to trigger the compromise, requiring no user interaction.