How Israeli firm’s ‘zero-click’ malware attack poses global security risk

What the report says

Al Jazeera reports that researchers have linked a new form of “zero-click” spyware delivery to the Israeli firm Candiru, after a campaign that targeted Al Jazeera staff devices in June 2025. The attack is described as unusual because it did not require a victim to open a file or tap a link; instead, malicious advertisements were used to identify targeted users and redirect them to an infected server. According to the article, the network activity was first noticed internally by Al Jazeera’s technology team in 2024, and a later investigation by the Canada-based Citizen Lab helped trace the operation.

The report says 45 devices used by Al Jazeera staff were affected, including those belonging to journalists covering sensitive subjects. It also notes that Candiru had previously been blacklisted by the US government in 2021. Al Jazeera said it condemned the targeting of its staff and called for accountability.

Beyond the newsroom case, the article frames the method as a wider security concern because it exploits the online advertising system itself. Researchers said the same ad infrastructure has appeared in networks connected to government bodies, international institutions and media outlets in several countries. The piece says this makes detection difficult and raises concern for journalists, officials and other high-risk targets.

Al Jazeera quotes cybersecurity experts who say the case shows how surveillance tools are evolving and how ad-tech systems can be abused at scale. The article also offers general protection advice, including ad blockers, privacy settings and stronger device protections, while noting that the broader industry and regulators may need to tighten controls.