Citizen Lab linked Candiru spyware infections at Al Jazeera to targeted ads that triggered attacks without clicks or user action.