An Israeli spyware firm, Candiru, has been identified as the perpetrator behind the first known instance of "zero-click" targeted advertising malware, which can steal private data without any user action. Researchers discovered that visiting or even refreshing a webpage can be enough to trigger the infection, compromising laptops and phones.

This sophisticated attack method represents a significant escalation in global cybersecurity threats, as it bypasses traditional security measures that rely on user interaction. The implications are far-reaching, suggesting that individuals can be targeted and their personal data exfiltrated without their knowledge or consent.

In June 2025, 45 devices used by Al Jazeera staff, including journalists reporting on sensitive topics, were compromised by this spyware. The malware installed itself without requiring users to open or download any files. An investigation by the Canada-based academic research unit Citizen Lab, prompted by Al Jazeera's internal probe, traced the attacks to Candiru.

Analysts describe the findings as "incredibly concerning," confirming the emergence of a novel global security risk. "We knew we were headed in this direction and now it is out in the public," stated Remesh Srinivasan, professor of information studies at the University of California in Los Angeles. He added, "This is the next level, because people are being microtargeted. This is the point we’ve come to when it comes to surveillance."

Al Jazeera's in-house technology team first noticed unusual activity on journalists' devices in 2024. Subsequent analysis of network logs, provided to Citizen Lab in 2025, revealed the attack's execution. Malicious advertisements were purchased by Discover-Tech, an Israeli company that presents itself as a legitimate advertising firm but acts as a facilitator for mercenary spyware operations.

Discover-Tech's ad network identified Al Jazeera staff and covertly redirected them to an infected server operated by Candiru. The spyware firm had previously been blacklisted by the U.S. government in 2021 by Citizen Lab for its involvement in the illegal hacking and surveillance of at least 100 activists, journalists, and political figures across 10 countries.

Al Jazeera Media Network has issued a strong condemnation of the attacks on its staff's devices, demanding accountability for those responsible. Cybersecurity analyst Eddy Willems noted that such advertisements can automatically infect devices upon display, executing code within the browser without requiring any explicit user clicks.