Online advertising campaigns infected devices at Al Jazeera with Candiru spyware without requiring targets to click anything.