How an Israeli Firm’s ‘Zero-Click’ Malware Attack Poses a Global Security Risk

In June 2025, 45 devices used by Al Jazeera staff, including journalists covering sensitive subjects, were targeted by spyware that installed without anyone opening or downloading a file. An investigation by Citizen Lab, prompted by Al Jazeera’s initial internal inquiry, traced the attacks to Israeli company Candiru. Researchers described a new form of “zero-click” targeted advertising: simply visiting a page or refreshing an app can enable data theft and transmission to external servers. Remesh Srinivasan, a professor at the University of California, Los Angeles, called the findings deeply concerning and said they marked a new level of targeted surveillance.