{"id":9250,"date":"2026-10-16T15:53:23","date_gmt":"2026-10-16T15:53:23","guid":{"rendered":"https:\/\/sotnews.agency\/?p=9250"},"modified":"2026-10-16T15:53:23","modified_gmt":"2026-10-16T15:53:23","slug":"how-israeli-firms-zero-click-malware-attack-poses-global-security-risk-cybersecurity-news","status":"publish","type":"post","link":"https:\/\/sotnews.agency\/?p=9250","title":{"rendered":"How Israeli firm\u2019s \u2018zero-click\u2019 malware attack poses global security risk | Cybersecurity News"},"content":{"rendered":"
\n
\n \t<\/i> Read Time:<\/span>5 Minute, 39 Second <\/div>\n\n <\/div>


\n<\/p>\n

\n

Just visiting a page or refreshing an app can be enough to fall victim to a malware attack in which your personal data is stolen from a laptop or phone, researchers have found. You are not even required to \u201cclick\u201d on anything.<\/p>\n

An Israeli spyware firm has been found to be behind the first-known instance of \u201czero-click\u201d targeted advertising<\/a> in which fraudsters or spies can steal private data and send it to external servers, with Al Jazeera journalists among the victims.<\/p>\n

\n

Recommended Stories <\/h2>\n

list of 3 items<\/span>end of list<\/span><\/section>\n

In June 2025, 45 devices used by Al Jazeera staff \u2013 including several who reported on sensitive subjects \u2013 were targeted with spyware which installed itself without the need to open or download any files.<\/p>\n

An investigation by the Canada-based academic research unit Citizen Lab, prompted by Al Jazeera\u2019s initial internal probe into the issue, discovered that the Israeli company Candiru was behind the attacks.<\/p>\n

Analysts say the findings are \u201cincredibly concerning\u201d, as they confirm the existence of a new global security threat. \u201cWe knew we were headed in this direction and now it is out in the public,\u201d Remesh Srinivasan, professor of information studies at the University of California in Los Angeles, US, told Al Jazeera.<\/p>\n

\u201cThis is the next level, because people are being microtargeted,\u201d he said. \u201cThis is the point we\u2019ve come to when it comes to surveillance.\u201d<\/p>\n

How \u2018zero-click\u2019 malware works<\/h2>\n

Al Jazeera\u2019s in-house technology team first discovered unusual patterns on devices used by some journalists in 2024. Analysis of network logs provided to the Citizen Lab by Al Jazeera in 2025 provided a clear temporal signature of how the attack was executed.<\/p>\n

Malicious advertisements were bought by Discover-Tech, an Israeli company presenting itself as a legitimate advertising firm, but which actually operates as a facilitator for mercenary spyware partners.<\/p>\n

Its advertisement network identified Al Jazeera staff, then quietly redirected them to an infected server belonging to Candiru. The spyware firm was blacklisted by the US government in 2021, when Citizen Lab found it was responsible for the illegal hacking and surveillance of at least 100 activists<\/a>, journalists and political activists across 10 countries.<\/p>\n

Al Jazeera Media Network has condemned the targeting of its staff members\u2019 devices and called for those responsible to be held accountable.<\/p>\n

Cybersecurity analyst and author Eddy Willems said the advertisements used automatically infect devices the moment they pop up on the screen, but there is an important technical nuance. \u201cExecuting code inside the browser does not automatically give an attacker full control over the computer,\u201d Willems told Al Jazeera.<\/p>\n

\u201cTo escape the browser\u2019s isolated environment \u2013 the \u2018sandbox\u2019 \u2013 the attacker may need a second vulnerability,\u201d Willems said, adding that an advanced spyware operation can combine several vulnerabilities.<\/p>\n

\u201cThe attacker attempts to exploit vulnerabilities to bypass security boundaries. This is precisely what makes this type of attack so dangerous,\u201d the analyst said.<\/p>\n

Once the device is infected, the malicious software is designed to collect a wide range of sensitive data, including files, documents, and browser data such as cookies, bookmarks, and saved credentials.<\/p>\n

It can also capture keystrokes, take screenshots, record microphone and webcam input, and extract emails and messages from popular communication platforms. To avoid triggering security mechanisms, the spyware often uses encrypted communication channels and breaks up stolen data into smaller chunks sent over time.<\/p>\n

Advertising: A new global security threat?<\/h2>\n

Analysts say Citizen Lab\u2019s findings point to the escalation of an existing threat, which expands the scale and reach of traditional cyberattacks and makes them much harder to detect.<\/p>\n

While \u201czero-click\u201d attacks are not completely new, the findings outline a new technique through which online advertisements are used as a route to infection.<\/p>\n

Stephen O\u2019Shaughnessy, a lecturer in cybersecurity at the TU Dublin Blanchardstown campus in Ireland, explained that when a user opens a website or app, an automated auction sells the advertisement space in a fraction of a second. That auction shares data about the victim, including the device ID, IP address, rough location and the app or site they are on.<\/p>\n

\u201cDiscover-Tech posed as an ordinary advertiser, used that data to find their target and win the auction for that person\u2019s screen,\u201d O\u2019Shaughnessy told Al Jazeera. \u201cAnyone with a phone or browser that shows ads can be reached, without the attacker needing their phone number or email.\u201d<\/p>\n

\u201cBecause no message or link is involved, there is almost nothing for the victim to notice,\u201d he added.<\/p>\n

Discover-Tech appeared on lists of \u201ccertified\u201d and \u201capproved\u201d vendors maintained by Google and advertising industry association IAB Europe, and has served advertisements via major networks such as Google, Yandex and Beeswax.<\/p>\n

In its report, Citizen Lab said this illustrates the structural flaws in the online advertising system, which essentially failed to detect or prevent the abuse.<\/p>\n

Discover-Tech advertisements have popped up on devices used by personnel in national-security-sensitive networks around the world, including those of various ministries of defence, armed forces, national cyber agencies, intergovernmental organisations and media outlets, Citizen Lab found.<\/p>\n

The research unit said these advertisements have also appeared on networks used by the United Nations, NATO, the European Parliament, the European Commission and the Council of the European Union\u2019s General Secretariat.<\/p>\n

\u2018Almost nobody was watching\u2019<\/h2>\n

Government networks have also been targeted in at least 24 countries, including the United States, Italy, Denmark, Norway, Australia, Russia, Mexico and Israel itself. Networks of media organisations have also been targeted, mainly in Australia, Denmark and Sweden, according to Citizen Lab.<\/p>\n

In a separate report, New York-based advertising security firm Confiant said its own investigations had found that some of Discover-Tech\u2019s advertisements also appeared in critical networks used by the Pentagon, the United Nations International Atomic Energy Agency and the International Criminal Court.<\/p>\n

O\u2019Shaughnessy said infection has not been confirmed there \u2013 only profiling of users. \u201cBut that alone is concerning, he said. \u201cThe ad system was built to send code from strangers to billions of screens with pinpoint targeting. Almost nobody was watching it from a security angle.\u201d<\/p>\n

The analyst said the risk remains low for most people as these attacks are expensive and aimed at specific targets. \u201cFor individuals at high risk, like journalists and officials, the best first defence is to install an ad blocker, switch off their advertising ID through their phone\u2019s privacy settings, keep everything updated, and turn on Lockdown Mode or Android\u2019s Advanced Protection,\u201d he said.<\/p>\n

Precautions also need to be taken within the industry and at government level. \u201cTo combat this, the ad industry needs to properly vet who\u2019s buying ads,\u201d O\u2019Shaughnessy said, while \u201cregulators need to stop personal data being sprayed out to thousands of unknown bidders in every auction.\u201d<\/p>\n<\/div>\n\n

\n
\n \n
\n \n \"Happy\"\n <\/a>\n
\n Happy <\/div>\n
\n 0<\/span>\n \n 0<\/span> %<\/span>\n <\/div>\n <\/div>\n\n
\n \n \"Sad\"\n <\/a>\n
\n Sad <\/div>\n
\n 0<\/span>\n 0<\/span> %<\/span>\n <\/div>\n <\/div>\n\n
\n \n \"Excited\"\n <\/a>\n
\n Excited <\/div>\n
\n 0<\/span>\n 0<\/span> %<\/span>\n <\/div>\n <\/div>\n\n
\n \n \"Sleepy\"\n <\/a>\n
\n Sleepy <\/div>\n
\n 0<\/span>\n \n 0<\/span> %<\/span>\n <\/div>\n <\/div>\n\n
\n \n \"Angry\"\n <\/a>\n
Angry<\/div>\n
\n 0<\/span>\n 0<\/span> %<\/span>\n \n <\/div>\n <\/div>\n\n
\n \n \"Surprise\"\n <\/a>\n
Surprise<\/div>\n
\n 0<\/span>\n 0<\/span> %<\/span>\n <\/div>\n <\/div>\n\n <\/div>\n <\/div>\n\n ","protected":false},"excerpt":{"rendered":"

Just visiting a page or refreshing an app can be enough to fall victim to a malware attack in which your personal data is stolen from a laptop or phone, researchers have found. You are not even required to \u201cclick\u201d on anything. An Israeli spyware firm has been found to be behind the first-known instance…<\/p>\n","protected":false},"author":1,"featured_media":9251,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rop_custom_images_group":[],"rop_custom_messages_group":[],"rop_publish_now":"initial","rop_publish_now_accounts":{"facebook_2277560469115098_106292521332774":"","twitter_aToxNzczMzI3Njk4OTg4ODUxMjAxOw==_1773327698988851200":""},"rop_publish_now_history":[],"rop_publish_now_status":"pending","_monsterinsights_skip_tracking":false,"_templately_pack_id":"","_templately_imported_at":"","_templately_source":"","_templately_import_session_id":"","footnotes":""},"categories":[11],"tags":[],"class_list":["post-9250","post","type-post","status-publish","format-standard","has-post-thumbnail","category-international-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t