'Zero-click' ad-based attack discovered, analysts warn of global security threat

Simply visiting a website or refreshing an app can be enough to fall victim to a malware attack that steals personal data from a computer or phone. The victim does not even need to "click" on anything.

According to researchers, an Israeli spyware company is behind the first known case of a "zero-click" attack delivered through targeted advertising, in which criminals or spies can steal private data and send it to external servers. Al Jazeera journalists were among the victims.

In June 2025, 45 devices used by Al Jazeera staff — many of them reporting on sensitive topics — were attacked with self-installing spyware that required no file to be opened or downloaded.

An investigation by Citizen Lab, a Canada-based academic research group, prompted by Al Jazeera's own initial internal probe, found that Israel's Candiru was behind the attacks.

Analysts described the findings as "extremely alarming" because they confirm the existence of a new global security threat. "We knew we were heading in this direction, and now it has been made public," Ramesh Srinivasan, a professor of information studies at the University of California, Los Angeles, told Al Jazeera.

"This is the next level, because humans are being micro-targeted," he said. "This is the point we have reached when it comes to surveillance."

How 'zero-click' malware works

Al Jazeera's in-house technology team first spotted anomalies on some journalists' devices in 2024. Analysis of network logs that Al Jazeera provided to Citizen Lab in 2025 revealed a clear timeline of how the attack was carried out.

The malicious ads were bought by Discover-Tech, an Israeli company that presents itself as a legitimate advertising firm but in reality operates as a support outfit for mercenary spyware partners.

The company's ad network identified Al Jazeera employees and then quietly redirected them to a poisoned server belonging to Candiru. The spyware firm was blacklisted by the US government in 2021, after Citizen Lab found it was responsible for the illegal hacking and surveillance of at least 100 activists, journalists and political figures across 10 countries.

Al Jazeera Media Network condemned the targeting of its staff's devices and called for those responsible to be held to account.

Cybersecurity analyst and author Eddy Willems said the ads used would automatically infect a device as soon as they appeared on screen, but noted an important technical nuance. "Executing code inside a browser does not automatically give an attacker full control of the computer," Willems told Al Jazeera.

"To escape the browser's isolated environment — the 'sandbox' — an attacker may need a second vulnerability," Willems said, adding that a sophisticated spyware campaign could combine multiple exploits.

"The attacker tries to exploit vulnerabilities to cross security boundaries. That is exactly what makes this kind of attack so dangerous," the analyst said.

Once a device is infected, the malware is designed to harvest a wide range of sensitive data, including files, documents and browser data such as cookies, bookmarks and saved credentials.

It can also log keystrokes, take screenshots, record from the microphone and webcam, and extract emails and messages from popular communication platforms. To avoid triggering security mechanisms, spyware often uses encrypted communication channels and splits stolen data into multiple parts sent over time.

Advertising: a new global security threat?

Analysts say Citizen Lab's findings point to an escalation of an existing threat, expanding the scale and reach of traditional cyberattacks and making them far harder to detect.

While "zero-click" attacks are not entirely new, the findings describe a novel technique in which online advertising is used as the infection pathway.

Stephen O'Shaughnessy, a cybersecurity lecturer at TU Dublin Blanchardstown in Ireland, explained that when a user opens a website or app, an automated auction sells the ad space in a fraction of a second. That auction shares data about the victim, including device ID, IP address, approximate location and the app or site they are visiting.

"Discover-Tech poses as an ordinary advertiser, uses that data to find its targets and wins the auction for that person's screen," O'Shaughnessy told Al Jazeera. "Anyone with a phone or a browser that displays ads can be reached, without the attacker needing their phone number or email."

"Because there is no message or link involved, victims have almost nothing to notice," he added.

Discover-Tech has appeared on lists of "certified" and "approved" vendors maintained by Google and the advertising industry body IAB Europe, and has distributed ads through major networks including Google, Yandex and Beeswax.

In its report, Citizen Lab argued this reflects structural vulnerabilities in the online advertising system, which has fundamentally failed to detect or prevent abuse.

Citizen Lab found that Discover-Tech ads appeared on devices belonging to personnel at national-security-sensitive networks around the world, including multiple defence ministries, armed forces, national cybersecurity agencies, intergovernmental organizations and media outlets.

The research group said the ads also appeared on networks used by the United Nations, NATO, the European Parliament, the European Commission and the Secretariat of the Council of the European Union.

'Almost no one is watching'

Government networks were also targeted in at least 24 countries, including the United States, Italy, Denmark, Norway, Australia, Russia, Mexico and Israel itself. According to Citizen Lab, networks of media organizations were targeted too, mainly in Australia, Denmark and Sweden.

In a separate report, New York-based ad security firm Confiant said its investigations also found some Discover-Tech ads appearing on critical networks used by the Pentagon, the UN's International Atomic Energy Agency and the International Criminal Court.

O'Shaughnessy said infections at those locations have not been confirmed — only user profiles were identified. "But that alone is concerning," he said. "The advertising system is built to deliver code from strangers to billions of screens with precise targeting. Almost no one is watching it from a security perspective."

The analyst said the risk remains low for most people because these attacks are costly and aimed at specific targets. "For high-risk individuals such as journalists and officials, the best first line of defence is to install an ad blocker, switch off the advertising ID in your phone's privacy settings, update everything and enable Lockdown Mode or Android's Advanced Protection," he said.

Preventive measures are also needed across the industry and at government level. "To counter this, the ad industry needs to vet who is buying advertising," O'Shaughnessy said, while "regulators need to stop personal data being broadcast to thousands of unidentified bidders in every auction."