How Israeli firm’s ‘zero-click’ malware attack poses global security risk

Just visiting a page or refreshing an app can be enough to fall victim to a malware attack in which your personal data is stolen from a laptop or phone, researchers have found. You are not even required to “click” on anything.An Israeli spyware firm has been found to be behind the first-known instance of “zero-click” targeted advertising in which fraudsters or spies can steal private data and send it to external servers, with Al Jazeera journalists among the victims.Recommended Stories list of 3 itemslist 1 of 3A world on trial: How lawyers documenting Israeli abuse pay a pricelist 2 of 3EU lawmaker investigating surveillance hacked by Israeli spyware, report sayslist 3 of 3UK, US, Netherlands warn of Iran-linked spywareend of listIn June 2025, 45 devices used by Al Jazeera staff – including several who reported on sensitive subjects – were targeted with spyware which installed itself without the need to open or download any files.An investigation by the Canada-based academic research unit Citizen Lab, prompted by Al Jazeera’s initial internal probe into the issue, discovered that the Israeli company Candiru was behind the attacks.Analysts say the findings are “incredibly concernin...