Key points
- Al Jazeera journalists were infected with AdFection spyware via zero-click ad delivery in 2024.
- The attack was facilitated by Israeli firms Candiru and Discover-Tech, with Candiru building the tool.
- The malware harvested emails, messages, credentials, and media without any user interaction required.
Al Jazeera journalists had their devices infected with surveillance malware through online advertisements that required no clicks or interaction to execute the attack. This incident represents the first confirmed case of zero-click mercenary spyware being delivered via ad infrastructure, according to findings from Citizen Lab and Al Jazeera released after the 2024 discovery.
How it unfolded
- In 2024, Al Jazeera journalists noticed unusual device behavior and contacted Canadian cybersecurity firm Citizen Lab for investigation.
- Citizen Lab confirmed the devices were infected with AdFection, a zero-click spyware delivered through served online ads.
- Researchers identified Israeli firms Candiru and Discover-Tech as the facilitators, with Candiru building the infostealer tool.
Who is affected
Al Jazeera journalists are the confirmed victims in this operation, though researchers noted the total number of victims could be significantly larger. The malware, described as costing several million dollars, was capable of harvesting sensitive data including files, documents, cookies, bookmarks, and saved credentials. It also captured keystrokes, took screenshots, and recorded audio and video via microphone and camera access.
What happens next
The specific entity that purchased the surveillance tool and directed the spying remains unidentified by researchers. However, the operation was linked to Candiru, now known as Integrity Labs, and Discover-Tech. Candiru was placed on the US Department of Commerce blacklist in November 2021 for supplying spyware to foreign governments targeting officials and activists.
The background in plain language
Zero-click attacks exploit software flaws to install malware without any user action, such as clicking a link. Ad-tech infrastructure delivers promotional content to websites, which can be hijacked to serve malicious code instead. Mercenary spyware refers to surveillance tools sold by private companies to government clients. Teams usually monitor for unusual network traffic or resource usage, as these attacks often leave subtle traces in system logs or memory that indicate unauthorized access or data exfiltration attempts.
Background: Unauthorized access
Yes, they are different. Unauthorized access means entering a system without permission. Unauthorized use means entering with permission but acting beyond allowed boundaries. Access violations trigger perimeter alerts. Use violations require behavioral analysis to detect, as the actor already possesses valid credentials and expected network presence.
Read the full guide: Difference Between Unauthorized Access and Unauthorized Use Explained
What to do and how to stay safe: AdFection
- Monitor device performance and network traffic for unusual spikes or unexpected behavior that may indicate hidden processes.
- Review installed applications and browser extensions regularly to identify any unauthorized software or suspicious add-ons.
- Keep operating systems and browsers updated to patch known vulnerabilities that could allow zero-click exploitation.
- Use strong, unique passwords and enable multi-factor authentication to limit damage if credentials are compromised.
Step-by-step guide: How to Prevent Data Exfiltration: Stop Silent Data Loss
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the journalists have to click on the ad to get infected?
No, the AdFection spyware was a zero-click attack, meaning it infected devices simply by being served on the screen.
Which companies were involved in creating this spyware?
Israeli firms Candiru (now Integrity Labs) and Discover-Tech facilitated the operation, with Candiru building the tool.
What kind of data did the spyware steal?
The malware harvested emails, instant messages, files, credentials, keystrokes, screenshots, and audio/video recordings.
