Just visiting a page or refreshing an app can be enough to fall victim to a malware attack in which your personal data is stolen from a laptop or phone, researchers have found.
asserted
researchers → visit → laptop
You are not even required to “click” on anything.
asserted
You → require → anything
An Israeli spyware firm has been found to be behind the first-known instance of “zero-click” targeted advertising in which fraudsters or spies can steal private data and send it to external servers, with Al Jazeera journalists among the victims.
asserted
journalists → find → victims
Recommended Stories
list of 3 items- list 1 of 3A world on trial: How lawyers documenting Israeli abuse pay a price
- list 2 of 3EU lawmaker investigating surveillance hacked by Israeli spyware, report says
- list 3 of 3UK, US, Netherlands warn of Iran-linked spyware
In June 2025, 45 devices used by Al Jazeera staff – including several who reported on sensitive subjects – were targeted with spyware which installed itself without the need to open or download any files.
asserted
which → document → files
An investigation by the Canada-based academic research unit Citizen Lab, prompted by Al Jazeera’s initial internal probe into the issue, discovered that the Israeli company Candiru was behind the attacks.
asserted
company → base → attacks
Analysts say the findings are “incredibly concerning”, as they confirm the existence of a new global security threat.
asserted
they → say → threat
“We knew we were headed in this direction and now it is out in the public,” Remesh Srinivasan, professor of information studies at the University of California in Los Angeles, US, told Al Jazeera.
asserted
Srinivasan → know → Jazeera
“This is the next level, because people are being microtargeted,” he said.
asserted
he → microtargete → ?
“This is the point we’ve come to when it comes to surveillance.”
asserted
it → come → surveillance
How ‘zero-click’ malware works
Al Jazeera’s in-house technology team first discovered unusual patterns on devices used by some journalists in 2024.
asserted
team → work → 2024
Analysis of network logs provided to the Citizen Lab by Al Jazeera in 2025 provided a clear temporal signature of how the attack was executed.
asserted
attack → provide → signature
Malicious advertisements were bought by Discover-Tech, an Israeli company presenting itself as a legitimate advertising firm, but which actually operates as a facilitator for mercenary spyware partners.
asserted
which → buy → partners
Its advertisement network identified Al Jazeera staff, then quietly redirected them to an infected server belonging to Candiru.
asserted
network → identify → Candiru
The spyware firm was blacklisted by the US government in 2021, when Citizen Lab found it was responsible for the illegal hacking and surveillance of at least 100 activists, journalists and political activists across 10 countries.
asserted
it → blacklist → countries
Al Jazeera Media Network has condemned the targeting of its staff members’ devices and called for those responsible to be held accountable.
asserted
those → condemn → devices
Cybersecurity analyst and author Eddy Willems said the advertisements used automatically infect devices the moment they pop up on the screen, but there is an important technical nuance.
asserted
they → say → screen
“Executing code inside the browser does not automatically give an attacker full control over the computer,” Willems told Al Jazeera.
asserted
Willems → execute → Jazeera
“To escape the browser’s isolated environment – the ‘sandbox’ – the attacker may need a second vulnerability,” Willems said, adding that an advanced spyware operation can combine several vulnerabilities.
uncertain
operation → escape → vulnerabilities
“The attacker attempts to exploit vulnerabilities to bypass security boundaries.
asserted
attacker → attempt → boundaries
This is precisely what makes this type of attack so dangerous,” the analyst said.
asserted
analyst → make → attack
Once the device is infected, the malicious software is designed to collect a wide range of sensitive data, including files, documents, and browser data such as cookies, bookmarks, and saved credentials.
asserted
software → infect → cookies
It can also capture keystrokes, take screenshots, record microphone and webcam input, and extract emails and messages from popular communication platforms.
asserted
It → capture → platforms
To avoid triggering security mechanisms, the spyware often uses encrypted communication channels and breaks up stolen data into smaller chunks sent over time.
asserted
spyware → avoid → time
Analysts say Citizen Lab’s findings point to the escalation of an existing threat, which expands the scale and reach of traditional cyberattacks and makes them much harder to detect.
asserted
them → say → cyberattacks
While “zero-click” attacks are not completely new, the findings outline a new technique through which online advertisements are used as a route to infection.
asserted
advertisements → outline → infection
Stephen O’Shaughnessy, a lecturer in cybersecurity at the TU Dublin Blanchardstown campus in Ireland, explained that when a user opens a website or app, an automated auction sells the advertisement space in a fraction of a second.
asserted
auction → explain → second
That auction shares data about the victim, including the device ID, IP address, rough location and the app or site they are on.
asserted
they → share → ID
“Discover-Tech posed as an ordinary advertiser, used that data to find their target and win the auction for that person’s screen,” O’Shaughnessy told Al Jazeera.
asserted
O’Shaughnessy → pose → Jazeera
“Anyone with a phone or browser that shows ads can be reached, without the attacker needing their phone number or email.
asserted
attacker → show → number
“Because no message or link is involved, there is almost nothing for the victim to notice,” he added.
asserted
he → involve → ?
Discover-Tech appeared on lists of “certified” and “approved” vendors maintained by Google and advertising industry association IAB Europe, and has served advertisements via major networks such as Google, Yandex and Beeswax.
asserted
Tech → appear → Google
In its report, Citizen Lab said this illustrates the structural flaws in the online advertising system, which essentially failed to detect or prevent the abuse.
asserted
which → say → abuse
Discover-Tech advertisements have popped up on devices used by personnel in national-security-sensitive networks around the world, including those of various ministries of defence, armed forces, national cyber agencies, intergovernmental organisations and media outlets, Citizen Lab found.
asserted
Lab → pop → defence
The research unit said these advertisements have also appeared on networks used by the United Nations, NATO, the European Parliament, the European Commission and the Council of the European Union’s General Secretariat.
asserted
advertisements → say → Secretariat
‘Almost nobody was watching’
asserted
nobody → watch → ?
Government networks have also been targeted in at least 24 countries, including the United States, Italy, Denmark, Norway, Australia, Russia, Mexico and Israel itself.
asserted
networks → target → States
Networks of media organisations have also been targeted, mainly in Australia, Denmark and Sweden, according to Citizen Lab.
uncertain
Networks → target → Lab
In a separate report, New York-based advertising security firm Confiant said its own investigations had found that some of Discover-Tech’s advertisements also appeared in critical networks used by the Pentagon, the United Nations International Atomic Energy Agency and the International Criminal Court.
asserted
some → base → Pentagon
O’Shaughnessy said infection has not been confirmed there – only profiling of users.
asserted
infection → say → users
“But that alone is concerning, he said.
asserted
he → say → ?
…and 6 more, not listed.
The Aporia
