TRENDING
Friday, 16 October 2026
----------------------
5 Jumada Al-Awwal 1448 AH
A new investigation reveals how an Israeli firm weaponized online advertising to deliver 'zero-click' spyware, compromising sensitive targets globally without a trace. This represents a profound escalation in digital espionage.
An investigation by Citizen Lab has uncovered a sophisticated new method of digital espionage: "zero-click" malware delivered through seemingly legitimate online advertisements. The Israeli firm Candiru, previously blacklisted by the US government for illegal hacking, is identified as the developer behind this advanced spyware. Its partner, Discover-Tech, masqueraded as an advertising company to exploit the global ad network, targeting at least 45 devices belonging to Al Jazeera staff in June 2025, alongside numerous government and intergovernmental organizations worldwide, without requiring any interaction from the victims.
The revelation of Candiru's "zero-click" spyware, deployed via the ubiquitous online advertising ecosystem, lays bare several critical power dynamics at play in the digital realm. First, it highlights the unchecked proliferation of mercenary spyware firms. These private entities, often operating with a degree of plausible deniability, develop and sell advanced surveillance tools that rival the capabilities of state intelligence agencies. Their existence creates a shadow market for digital weapons, enabling a wider range of actors – from authoritarian regimes to less scrupulous state intelligence units – to acquire sophisticated offensive cyber capabilities without the direct political accountability that comes with state-led operations. The fact that Candiru was blacklisted by the US in 2021, yet its tools continue to be deployed, underscores the limitations of current international regulatory frameworks.
Second, this incident exposes the profound vulnerability inherent in the global online advertising infrastructure. The system, designed to micro-target consumers with ads, relies on the rapid exchange of user data – including device IDs, IP addresses, and rough locations – in real-time auctions. Discover-Tech exploited this very mechanism, using publicly available ad networks like Google, Yandex, and Beeswax to identify and redirect specific targets to infected servers. This represents a weaponization of commercial digital infrastructure, transforming a system built for commerce into a conduit for espionage. The power here lies in the ability to subvert global digital commons for specific, often opaque, intelligence objectives, turning ordinary web browsing into a potential vector for compromise.
Third, the "zero-click" nature of the attack fundamentally shifts the balance of power in digital defense. Traditional cybersecurity relies heavily on user vigilance – avoiding suspicious links or downloads. A zero-click exploit bypasses this entirely, infecting devices without any user interaction. This places an immense burden on the target, making detection incredibly difficult and defense almost impossible for individuals. The attacker holds almost all the cards, leveraging highly expensive and technically complex vulnerabilities that are beyond the reach of most organizations, let alone individual journalists or activists. This asymmetry of power ensures that only those with significant resources can hope to develop countermeasures, leaving the vast majority exposed.
Finally, the global reach of these attacks – impacting networks in 24 countries, including those of the United Nations, NATO, the European Parliament, and the Pentagon – demonstrates the borderless nature of this digital threat. It's not merely a bilateral issue but a systemic challenge to global digital security. The power to gather intelligence on such a wide array of sensitive targets offers immense leverage, influencing everything from diplomatic negotiations to military strategies. This capability allows powerful actors to gain an unseen advantage, shaping global narratives and decisions from the digital shadows.
While the technical sophistication of "zero-click" spyware is often the focus, the true impact ripples through the lives of individuals and the integrity of institutions globally. The human cost is multifaceted, striking at fundamental rights and the very fabric of open societies.
Journalists, particularly those working for outlets like Al Jazeera that report on sensitive geopolitical issues, bear a direct and heavy cost. The compromise of their devices means that their sources, communications, and ongoing investigations are exposed. This not only endangers the journalists themselves, potentially leading to physical harm or arbitrary detention, but also creates a chilling effect on reporting. Sources, fearing exposure, may become reluctant to share critical information, effectively stifling independent journalism and public accountability. When the media's ability to scrutinize power is undermined, the public's right to information is diminished, leaving citizens less informed and more vulnerable to manipulation.
The "zero-click" nature of these attacks means that simply visiting a webpage or refreshing an app can lead to compromise. This fundamentally erodes trust in the digital spaces that have become integral to modern life. For ordinary citizens, the knowledge that their devices can be silently infiltrated without any action on their part breeds pervasive anxiety and a sense of powerlessness. It transforms the internet from a tool for connection and information into a potential vector for invisible surveillance, impacting personal privacy, freedom of expression, and the ability to communicate securely. The psychological toll of living under constant, unseen digital threat is immeasurable.
The targeting of government networks, defense ministries, intergovernmental organizations like the UN and NATO, and even bodies like the International Criminal Court, carries profound implications for global security and governance. The compromise of sensitive data from these entities can lead to national security breaches, diplomatic crises, and the erosion of trust between nations. It can expose strategic plans, intelligence operations, and the personal data of high-ranking officials, creating opportunities for blackmail, sabotage, or geopolitical manipulation. The integrity of international institutions, crucial for maintaining global stability, is directly threatened when their digital defenses are so easily bypassed by mercenary tools.
The public narrative around sophisticated cyberattacks often focuses on the technical prowess of the attackers or the identity of the targets. However, the true "untold story" lies in the systemic vulnerabilities and the convenient silences that enable such operations to flourish.
The most significant omission in public discourse is the deep, structural complicity of the online advertising industry. Discover-Tech was able to operate as a front for a spyware firm because the ad tech ecosystem is inherently designed for mass data collection and rapid, automated transactions with minimal oversight. Major platforms like Google and industry bodies like IAB Europe listed Discover-Tech as an approved vendor. This isn't just a flaw; it's a feature. The industry's business model thrives on collecting and sharing vast amounts of user data, creating a rich hunting ground for intelligence agencies and mercenary firms. The "untold story" is that the very infrastructure that powers much of the internet is a porous, unregulated frontier, where the line between commercial targeting and state-sponsored surveillance has become dangerously blurred. The industry has little incentive to police itself rigorously when its profits are tied to the very data flows that make such attacks possible.
While Candiru is an Israeli firm, and the US blacklisted it, the broader context of state sponsorship and tolerance for such firms remains largely unaddressed. Governments globally are simultaneously victims and potential beneficiaries of this mercenary spyware market. Many nations, including powerful ones, likely acquire or develop similar capabilities, creating a tacit acceptance of the industry's existence. The "untold story" is the strategic ambiguity employed by states: condemning attacks when they are victims, but often turning a blind eye, or even actively engaging, when they can leverage such tools for their own intelligence objectives. This creates a permissive environment where firms like Candiru can thrive, knowing that while they might face sanctions from one power, others might still be willing clients or at least tolerate their operations.
The focus on specific incidents often obscures the larger "arms race" underway in offensive cyber capabilities. The development of "zero-click" exploits is incredibly expensive and requires significant resources, suggesting a continuous investment in this sector. The "untold story" is that this is not an isolated incident but a symptom of a global proliferation of sophisticated cyber weapons. These tools, once the exclusive domain of a few top-tier nation-states, are now being commercialized and sold to a wider array of governments, significantly lowering the barrier to entry for advanced digital espionage. This commercialization accelerates the arms race, making the digital landscape increasingly volatile and dangerous for everyone, not just high-value targets.
As the digital battlefield continues to evolve, several key areas will indicate the trajectory of this "zero-click" surveillance threat and the broader response to it.
First, observe the regulatory and legislative response from major global powers. Will the revelations about Candiru and Discover-Tech spur concrete international efforts to regulate the mercenary spyware industry, or will national security interests continue to overshadow calls for greater oversight? Look for any coordinated initiatives from the UN, EU, or individual nations to impose stricter controls on the development, sale, and export of such dual-use technologies. A lack of meaningful action would signal a continued tolerance for this shadow industry.
Second, pay close attention to the accountability of the online advertising industry. Will major ad platforms like Google implement fundamental changes to their vetting processes and data sharing practices, or will they continue to prioritize revenue over security? Any significant reforms to how ad space is auctioned and how data is shared could disrupt the current model that enables firms like Discover-Tech to operate. Conversely, a business-as-usual approach will confirm the industry's continued vulnerability.
Third, monitor the proliferation of similar "zero-click" methods and the emergence of new attack vectors. As defenses against current techniques improve, attackers will inevitably seek new vulnerabilities. Watch for reports of sophisticated exploits leveraging other common digital infrastructure, such as messaging apps, operating systems, or even hardware, moving beyond the advertising ecosystem. The evolution of these techniques will dictate the next frontier in digital defense.
Finally, observe the development and adoption of advanced defensive measures. While ad blockers and privacy settings are recommended for individuals, the focus will shift to more robust, systemic solutions. Look for innovations in endpoint detection and response (EDR) technologies, operating system hardening (like Apple's Lockdown Mode), and network-level threat intelligence sharing among governments and private entities. The effectiveness of these countermeasures will determine whether the balance of power can be shifted back towards the defenders in this invisible digital war.
Zero-click spyware is malicious software that can infect a device without any interaction from the user, such as clicking a link or downloading a file. It exploits vulnerabilities in software to silently install itself, making it incredibly difficult to detect and defend against.
A firm named Discover-Tech posed as a legitimate advertiser and exploited the automated online ad auction system. This system shares user data to target ads, which Discover-Tech used to identify specific targets and redirect their devices to an infected server belonging to the spyware firm Candiru.
The spyware targeted a wide range of individuals and organizations, including Al Jazeera journalists, personnel in national security networks across 24 countries (like the US, Russia, and EU nations), and intergovernmental bodies such as the United Nations, NATO, and the International Criminal Court.
Source referenced: ALJAZEERA
This brief was synthesized by our Editorial Engine and reviewed by The Ground Narrative team.
