How Israeli firm’s ‘zero-click’ malware attack poses global security risk
News Source
•Fri, 16 Oct 2026 14:12:13 +0000
📰 What Happened
Researchers have found that simply opening a page or refreshing an app can be enough to hack your phone or laptop. No click is needed. An Israeli spyware firm called Candiru was behind the first known case of "zero-click" targeted advertising.
In June 2025, spyware infected 45 devices used by Al Jazeera staff. An investigation by Canada's Citizen Lab found it installed itself with no files opened or downloaded.
🔍 The Backstory
The attack worked through fake ads bought by a company called Discover-Tech. Its ad network found Al Jazeera staff, then quietly sent them to an infected server belonging to Candiru. Candiru was blacklisted by the US government in 2021 for spying on activists and journalists.
Once inside a device, the spyware can steal files, passwords and messages, and even turn on the camera and microphone. The fake ads were seen on networks used by governments in at least 24 countries.
🎯 Why It Matters
Anyone whose phone shows ads can be reached, and there is almost nothing to notice. Using an ad blocker and updating your devices helps protect you.
Researchers have found that simply opening a page or refreshing an app can be enough to hack your phone or laptop. No click is needed. An Israeli spyware firm called Candiru was behind the first known case of "zero-click" targeted advertising.
In June 2025, spyware infected 45 devices used by Al Jazeera staff. An investigation by Canada's Citizen Lab found it installed itself with no files opened or downloaded.
The attack worked through fake ads bought by a company called Discover-Tech. Its ad network found Al Jazeera staff, then quietly sent them to an infected server belonging to Candiru. Candiru was blacklisted by the US government in 2021 for spying on activists and journalists.
Once inside a device, the spyware can steal files, passwords and messages, and even turn on the camera and microphone. The fake ads were seen on networks used by governments in at least 24 countries.
Anyone whose phone shows ads can be reached, and there is almost nothing to notice. Using an ad blocker and updating your devices helps protect you.