Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that needed no click or other action from the user, researchers at the Citizen Lab said Thursday.

The hidden attack code ran the moment an ad loaded on the screen, and in some cases the ad loaded out of sight, in the background.

The Citizen