How Israeli firm’s ‘zero-click’ malware attack poses global security risk

A new ‘zero-click’ hack uses ads to target victims without any action needed on their part. Save Share Just visiting a page or refreshing an app can be enough to fall victim to a malware attack in which your personal data is stolen from a laptop or phone, researchers have found. You are not even required to “click” on anything. An Israeli spyware firm has been found to be behind thefirst-known instance of “zero-click” targeted advertisingin which fraudsters or spies can steal private data and send it to external servers, with Al Jazeera journalists among the victims. In June 2025, 45 devices used by Al Jazeera staff – including several who reported on sensitive subjects – were targeted with spyware which installed itself without the need to open or download any files. An investigation by the Canada-based academic research unit Citizen Lab, prompted by Al Jazeera’s initial internal probe into the issue, discovered that the Israeli company Candiru was behind the attacks. Analysts say the findings are “incredibly concerning”, as they confirm the existence of a new global security threat. “We knew we were headed in this direction and now it is out in the public,” Remesh Srinivasan, professor of information studies at the University of California in Los Angeles, US, told Al Jazeera. “This is the next level, because people are being microtargeted,” he said. “This is the point we’ve come to when it comes to surveillance.” Al Jazeera’s in-house technology team first discovered unusual patterns on devices used by some journalists in 2024. Analysis of network logs provided to the Citizen Lab by Al Jazeera in 2025 provided a clear temporal signature of how the attack was executed. Malicious advertisements were bought by Discover-Tech, an Israeli company presenting itself as a legitimate advertising firm, but which actually operates as a facilitator for mercenary spyware partners. Its advertisement network identified Al Jazeera staff, then quietly redirected them to an infected server belonging to Candiru. The spyware firm was blacklisted by the US government in 2021, when Citizen Lab found it was responsible for the illegal hacking and surveillance ofat least 100 activists, journalists and political activists across 10 countries. Al Jazeera Media Network has condemned the targeting of its staff members’ devices and called for those responsible to be held accountable....