Just visiting a page or refreshing an app can be enough to fall victim to a malware attack in which your personal data is stolen from a laptop or phone, researchers have found. You are not even required to “click” on anything. An Israeli spyware firm has been found to be behind the first-known instance of “zero-click” targeted advertising in which fraudsters or spies can steal private data and send it to external servers, with Al Jazeera journalists among the victims.
In June 2025, 45 devices used by Al Jazeera staff – including several who reported on sensitive subjects – were targeted with spyware which installed itself without the need to open or download any files. An investigation by the Canada-based academic research unit Citizen Lab, prompted by Al Jazeera’s initial internal probe into the issue, discovered that the Israeli company Candiru was behind the attacks. Analysts say the findings are “incredibly concerning”, as they confirm the existence of a new global security threat.
Analysis of network logs provided to the Citizen Lab by Al Jazeera in 2025 provided a clear temporal signature of how the attack was executed. Malicious advertisements were bought by Discover-Tech, an Israeli company presenting itself as a legitimate advertising firm, but which actually operates as a facilitator for mercenary spyware partners. Its advertisement network identified Al Jazeera staff, then quietly redirected them to an infected server belonging to Candiru.
The spyware firm was blacklisted by the US government in 2021, when Citizen Lab found it was responsible for the illegal hacking and surveillance of at least 100 activists, journalists and political activists across 10 countries. Al Jazeera Media Network has condemned the targeting of its staff members’ devices and called for those responsible to be held accountable. Cybersecurity analyst and author Eddy Willems said the advertisements used automatically infect devices the moment they pop up on the screen, but there is an important technical nuance.
This is precisely what makes this type of attack so dangerous,” the analyst said. Once the device is infected, the malicious software is designed to collect a wide range of sensitive data, including files, documents, and browser data such as cookies, bookmarks, and saved credentials. It can also capture keystrokes, take screenshots, record microphone and webcam input, and extract emails and messages from popular communication platforms.
To avoid triggering security mechanisms, the spyware often uses encrypted communication channels and breaks up stolen data into smaller chunks sent over time. Analysts say Citizen Lab’s findings point to the escalation of an existing threat, which expands the scale and reach of traditional cyberattacks and makes them much harder to detect. While “zero-click” attacks are not completely new, the findings outline a new technique through which online advertisements are used as a route to infection.
Extract — continue reading at the source.
