An investigation by Canada-based research unit Citizen Lab has revealed that the Israeli spyware firm Candiru was behind a series of attacks on 45 devices used by Al Jazeera staff, including journalists covering sensitive subjects. The attacks, which began in June 2025, used a novel "zero-click" technique, meaning victims were infected simply by visiting a webpage or refreshing an app, without clicking any links or downloading files.
Al Jazeera's in-house technology team first noticed unusual patterns on devices in 2024. Network logs provided to Citizen Lab in 2025 revealed how the operation unfolded. Malicious advertisements were purchased by Discover-Tech, an Israeli company posing as a legitimate advertising firm but acting as a facilitator for mercenary spyware partners. The network identified Al Jazeera staff and redirected them to servers controlled by Candiru, which then installed spyware automatically.
Candiru was blacklisted by the US government in 2021 after Citizen Lab linked it to the hacking of at least 100 activists, journalists, and political figures across 10 countries. Al Jazeera Media Network has condemned the targeting of its staff and called for accountability.
Experts described the findings as "incredibly concerning," confirming a new global security threat. Remesh Srinivasan, a professor of information studies at the University of California, Los Angeles, told Al Jazeera: "We knew we were headed in this direction and now it is out in the public. This is the next level, because people are being microtargeted. This is the point we've come to when it comes to surveillance."
Cybersecurity analyst Eddy Willems noted that the malicious advertisements automatically infect devices the moment they appear, but noted a technical nuance: executing code inside a browser does not automatically give an attacker full control over the computer, though the potential for data theft remains significant.