How the Israeli company's "Zero Click" malware attack poses a global security risk

A new "zero-click" hack uses ads to target victims without requiring any action on their part.

Researchers have found that just visiting a page or updating an app can make you the victim of a malware attack where your personal information is stolen from your laptop or phone. You don't even have to "click" on anything.

An Israeli spyware company has been found to be behind the first known example of "zero-click" targeted advertising, where fraudsters or spies can steal private data and send it to foreign servers, with Al Jazeera journalists among the victims.

List of 3 items List 1 of 3 World on Trial: How Israeli Abuse Documented Lawyers Pay

The report lists 2 of the 3 EU lawmakers who are investigating hacked espionage by Israeli spyware.

List 3 of 3 UK, US and Dutch warnings about Iran-related spyware

At the bottom of the list, in June 2025, 45 devices used by Al Jazeera staff — including several reporting on sensitive issues — were targeted with spyware that installed itself without opening or downloading any files.

An investigation by Canadian-based academic research unit Citizen Lab, prompted by Al Jazeera's initial internal investigation into the matter, found that the Israeli company Candiru was behind the attacks.

Analysts say the findings are "extremely worrying" because they confirm the existence of a new global security threat. Ramesh Srinivasan, a professor of information studies at the University of California, Los Angeles, told Al Jazeera: "We knew we were going in this direction and now it's out in the open.

"This is the next level, because people are being targeted." "That's where we're at with oversight," he said.

Al Jazeera's internal technology team first discovered unusual patterns in the devices used by some journalists in 2024. Analysis of network reports provided to Citizen Lab by Al Jazeera in 2025 provided a clear time signature of how the attack was carried out.

The malicious ads were purchased by Discover-Tech, an Israeli company that presents itself as a legitimate ad company, but actually acts as a facilitator for mercenary spyware partners.

Its ad network identified Al Jazeera employees, then quietly directed them to an infected server owned by Candiru. The spyware company was blacklisted by the US government in 2021 when Citizen Lab was found to be responsible for illegal hacking and surveillance of at least 100 activists, journalists and political activists in 10 countries.

Al Jazeera media network has condemned the targeting of its employees' devices and demanded accountability from its officials.

Ed Willems, a cyber security analyst and author, said the ads used automatically infect devices as soon as they appear on the screen, but there is an important technical catch. "Executing code inside the browser does not automatically give the attacker full control of the computer," Willems told Al Jazeera.

To escape from the browser's isolated environment - the "sandbox" - the attacker may need a second vulnerability, Willems said. A sophisticated spyware operation can combine several vulnerabilities.

An attacker tries to exploit vulnerabilities to bypass security boundaries. This is exactly what makes this type of attack so dangerous.

Once a device is infected, the malware is designed to collect a wide variety of sensitive data, including files, documents, and browser data such as cookies, bookmarks, and stored credentials.

It can also capture keystrokes, take screenshots, record microphone and webcam input, and extract emails and messages from popular communication platforms. To avoid security mechanisms, this spyware often uses encrypted communication channels and breaks the stolen data into smaller pieces.

Advertising: A New Global Security Threat?

Analysts say Citizen Lab's findings point to the intensification of an existing threat that expands the scale and scope of traditional cyberattacks, making them much more difficult to detect.

While zero-click attacks aren't exactly new, the findings reveal a new way in which online advertising is being used as a way to infect.

Stephen O'Shaughnessy, a lecturer in cyber security at TU Dublin's Blanchardstown campus in Ireland, explained that when a user opens a website or app, an automated auction sells ad space in a fraction of a second. This auction shares victim data, including device ID, IP address, specific location, and the app or site they are on.

O'Shaughnessy told Al Jazeera: "Discover-Tech posed as a regular advertiser and used this data to find their target and win the auction for that person's screen." "Anyone with a phone or browser displaying the ad can be contacted, without the attacker needing their phone number or email address."

"Since there is no message or link involved, there is almost nothing for the victim to notice," he added.

Discover-Tech appeared on the list of "verified" and "verified" vendors maintained by Google and the advertising industry association IAB Europe, and served ads through major networks such as Google, Yandex and Beeswax.

Citizen Lab said in its report that this indicates structural flaws in the online advertising system that fundamentally failed to detect or prevent abuse.

Citizen Lab found Discover-Tech ads appeared on devices used by personnel on national security-sensitive networks around the world, including various Departments of Defense, armed forces, national cyber agencies, intergovernmental organizations, and the media.

The research unit said the ads were also published on networks used by the United Nations, NATO, the European Parliament, the European Commission and the Council of the Secretariat of the European Union.

Government networks have also been targeted in at least 24 countries, including the United States, Italy, Denmark, Norway, Australia, Russia, Mexico, and Israel itself, according to Citizen Lab. Media organizations' networks have also been targeted mainly in Australia, Denmark, and Sweden.

In a separate report, New York-based ad security firm Confiant said its research found that some Discover-Tech ads appeared on critical networks used by the Pentagon, the UN's International Atomic Energy Agency and the International Criminal Court.

O'Shaughnessy said the infection isn't confirmed there — just the users' profiles. "But that alone is worrying," he said. “The ad system is built to send code from strangers to billions of screens with precise targeting. "Almost nobody was watching it from a security angle."

The risk is low for most people because these attacks are expensive and target specific targets, the analyst said. "For people at risk, like journalists and officials, the best first defense is to install an ad blocker, turn off your ad ID through their phone's privacy settings, keep everything up to date and turn on Lock Mode or Android Advanced Protection," he said.

It is also necessary to take precautionary measures in the industry and at the government level. "To combat this, the advertising industry needs to properly examine who is buying the ads," O'Shaughnessy said.