Cyber Awareness

Israeli Spyware Firm Linked to First ‘Zero‑Click’ Ad‑Based Malware Attack on Al Jazeera Staff

By Federica Marsi

A new form of malware that requires no user action—known as a ‘zero‑click’ attack—has been traced to an Israeli spyware company, Candiru, according to a study by the Canada‑based Citizen Lab. In June 2025, 45 devices used by Al Jazeera journalists, including those covering sensitive topics, were infected. The spyware installed itself without the need to open or download any files. The attack used targeted advertising to deliver malicious code; simply visiting a page or refreshing an app was enough to trigger the infection.

Citizen Lab’s investigation, prompted by Al Jazeera’s internal probe, revealed a clear temporal signature in network logs that showed how the malware was delivered. Once installed, the software harvested a wide range of sensitive data—files, documents, browser cookies, bookmarks, saved credentials, keystrokes, screenshots, microphone and webcam input, and emails or messages from popular communication platforms. To avoid detection, the spyware used encrypted channels and sent stolen data in small chunks over time.

Al Jazeera condemned the targeting of its staff and called for accountability. Analysts note that the attack exploits multiple vulnerabilities to escape a device’s sandbox, making it particularly dangerous. Remesh Srinivasan, a UCLA professor of information studies, said the incident confirms a new global security threat and represents a next level of micro‑targeted surveillance.

The study also found that government networks in at least 24 countries—including the United States, Italy, Denmark, Norway, Australia, Russia, Mexico and Israel—had been profiled, as had media networks in Australia, Denmark and Sweden. While infection has not been confirmed in those cases, the profiling alone is concerning.

Experts advise that individuals at high risk, such as journalists and officials, protect themselves by installing ad blockers, disabling advertising IDs, keeping software updated, and enabling advanced protection modes on their devices. They also call for the advertising industry to better vet buyers and for regulators to curb the distribution of personal data to unknown bidders in ad auctions.