Israeli spyware used in ‘zero click’ hack on Al Jazeera staff

Investigation

Al Jazeera and Citizen Lab investigated a zero-click spyware campaign that affected more than 45 devices belonging to Al Jazeera staff. According to the report, a device could be infected when a targeted ad loaded or appeared as someone scrolled; no click was required.

The spyware was attributed to Israeli company Candiru. It could capture keystrokes, screenshots, documents, passwords, browser data, and messages, as well as microphone or webcam input. It could then send the information to remote servers and was designed to conceal itself.

How the Attack Was Delivered

The investigation said advertising firm Discover Tech helped deliver the malicious ads. The firm allegedly used advertising tools to target people by location or individual IP address and exploited a Google Chrome vulnerability.

Google cooperated with the investigation and removed Discover Tech from its platform in October.

Candiru’s Surveillance Business

The report placed the campaign in the broader history of Candiru’s surveillance business. A leaked sales presentation described packages for hacking groups of users. In 2021, Citizen Lab reported that more than 100 journalists, activists, dissidents, and politicians had been targeted.

The US Commerce Department later blacklisted Candiru over spyware sales to foreign governments. The report said Candiru was acquired in 2025 by US investment firm Integrity Partners Limited, with its assets transferred to a new entity not under sanctions.

Response and Commentary

Al Jazeera condemned the targeting of its staff, saying attacks on journalists are attacks on press freedom and the public’s right to know. It said those responsible should be held accountable.

An unnamed commentator said the campaign reflects the growing precision of surveillance and the long involvement of Israeli companies in spyware. The report concluded that ad-based, highly targeted attacks make protecting personal data increasingly difficult.

Presenters and Contributors

• Mohamed Hassan: Presenter, identified in the video context
• Unnamed commentator