Israeli 'Zero-Click' Spyware Exploits Online Ads, Posing Global Security Threat

Al Jazeera Media Network has condemned spyware attacks that targeted several of its staff members. Researchers have discovered that merely visiting a webpage or refreshing an app can be enough to fall victim to a malware attack, leading to the theft of personal data from laptops or phones without any user interaction, such as clicking on a link.

An Israeli spyware firm, Candiru, has been identified as the source of the first-known instance of "zero-click" targeted advertising. This sophisticated method allows fraudsters or spies to steal private data and transmit it to external servers. Among the victims were journalists from Al Jazeera.

In June 2025, 45 devices utilized by Al Jazeera staff, including those reporting on sensitive subjects, were targeted. The spyware installed itself without requiring the opening or downloading of any files. An investigation by the Canada-based academic research unit Citizen Lab, initiated by Al Jazeera's internal probe, confirmed Candiru's involvement.

Analysts describe these findings as "incredibly concerning," as they validate the existence of a new global security threat. Remesh Srinivasan, a professor of information studies at the University of California in Los Angeles, stated, "We knew we were headed in this direction and now it is out in the public." He added, "This is the next level, because people are being microtargeted. This is the point we’ve come to when it comes to surveillance."

How ‘Zero-Click’ Malware Works

Al Jazeera's internal technology team first detected unusual activity on devices used by some journalists in 2024. Subsequent analysis of network logs, provided by Al Jazeera to Citizen Lab in 2025, revealed a clear temporal signature of the attack's execution.

Malicious advertisements were purchased by Discover-Tech, an Israeli company that presented itself as a legitimate advertising firm but acted as a facilitator for mercenary spyware partners. This firm's advertisement network identified Al Jazeera staff and covertly redirected them to an infected server belonging to Candiru.

Candiru was previously blacklisted by the US government in 2021, following Citizen Lab's discovery of its responsibility for the illegal hacking and surveillance of at least 100 activists, journalists, and political figures across 10 countries. Al Jazeera Media Network has issued a condemnation of the targeting of its staff and called for accountability.

Cybersecurity analyst Eddy Willems explained that the advertisements automatically infect devices upon appearing on screen, though he noted a technical nuance. "Executing code inside the browser does not automatically give an attacker full control over the computer," Willems told Al Jazeera. "To escape the browser’s isolated environment – the ‘sandbox’ – the attacker may need a second vulnerability." He further elaborated that advanced spyware operations can combine multiple vulnerabilities, stating, "The attacker attempts to exploit vulnerabilities to bypass security boundaries. This is precisely what makes this type of attack so dangerous."

Once a device is infected, the malicious software is designed to exfiltrate a wide range of sensitive data, including files, documents, browser data like cookies, bookmarks, and saved credentials. It can also capture keystrokes, take screenshots, record audio and video from microphones and webcams, and extract communications from various platforms.

To evade security mechanisms, the spyware often employs encrypted communication channels and fragments stolen data into smaller pieces transmitted over time.

Advertising: A New Global Security Threat?

Analysts suggest that Citizen Lab's findings signify an escalation of an existing threat, broadening the scale and reach of traditional cyberattacks and making them significantly harder to detect. While "zero-click" attacks are not entirely novel, the recent discoveries highlight a new technique utilizing online advertisements as an infection vector.

Stephen O’Shaughnessy, a lecturer in cybersecurity at TU Dublin Blanchardstown, explained the process: during the automated auction for ad space on websites or apps, data about the user, including device ID, IP address, approximate location, and the current site or app, is shared. "Discover-Tech posed as an ordinary advertiser, used that data to find their target and win the auction for that person’s screen," O’Shaughnessy told Al Jazeera. "Anyone with a phone or browser that shows ads can be reached, without the attacker needing their phone number or email." He emphasized the stealth of these attacks, noting, "Because no message or link is involved, there is almost nothing for the victim to notice."

Discover-Tech was listed among "certified" and "approved" vendors by Google and the advertising industry association IAB Europe, and served ads through major networks like Google, Yandex, and Beeswax. Citizen Lab's report indicates that this situation exposes structural flaws within the online advertising system, which failed to adequately detect or prevent such abuse.

Discover-Tech advertisements have appeared on devices within national-security-sensitive networks globally, including those of various ministries of defence, armed forces, national cyber agencies, intergovernmental organizations, and media outlets, according to Citizen Lab. These ads were also found on networks used by the United Nations, NATO, the European Parliament, the European Commission, and the Council of the European Union’s General Secretariat.

Government networks in at least 24 countries, including the United States, Italy, Denmark, Norway, Australia, Russia, Mexico, and Israel, have been targeted. Media organization networks in Australia, Denmark, and Sweden were also affected, as per Citizen Lab.

In a separate investigation, the New York-based advertising security firm Confiant reported that some of Discover-Tech’s advertisements appeared on critical networks used by the Pentagon, the United Nations International Atomic Energy Agency, and the International Criminal Court. O’Shaughnessy clarified that while infection wasn't confirmed in these instances, user profiling did occur, which he deemed concerning. "The ad system was built to send code from strangers to billions of screens with pinpoint targeting. Almost nobody was watching it from a security angle."

The analyst advised that the risk remains low for the general population due to the high cost and specific targeting of these attacks. However, for individuals at higher risk, such as journalists and officials, recommended defenses include installing an ad blocker, disabling advertising IDs in phone privacy settings, maintaining updated software, and enabling features like Lockdown Mode or Android's Advanced Protection.

Industry-wide and governmental precautions are also necessary. O’Shaughnessy urged, "To combat this, the ad industry needs to properly vet who’s buying ads," while "regulators need to stop personal data being sprayed out to thousands of unknown bidders in every auction."