Devices can now get hacked without even clicking!

You scroll through your social media feed, glance at a post or a banner ad, then move on. Nothing unusual. But in that split second, a seemingly harmless advertisement could silently compromise your phone or laptop, giving hackers access to your device without you ever clicking a thing.

A year-long investigation by Al Jazeera and Canadian cyber research group Citizen Lab has uncovered the first confirmed case of a zero-click spyware attack delivered through targeted digital advertising. It sounds alarming, but what exactly is a zero-click spyware attack, and how does it work?

Between 2024 and 2025, this investigation targeted more than 45 devices belonging to Al Jazeera staff, as well as networks at NATO, the United Nations, and the European Union. The probe began in 2025 after Al Jazeera’s technology team noticed unusual activity on the laptops of journalists covering sensitive stories.

Inside those machines, investigators found Trojan malware built by the Israeli surveillance firm Candiru. Once installed, the software burrows deep into a device to prevent detection. It records keystrokes, takes screenshots, activates microphones and webcams, and extracts passwords, documents, browser data, and private messages to external servers.

Delivering that malware required a second Israeli company named Discover Tech. It presented itself as a legitimate advertising firm and bought ad space across websites and social media platforms, the investigation found.

Because Google listed the company among its Ad Manager certified external vendors, it was able to serve ads across 200,000 unique websites and apps in dozens of countries.

Behind the scenes, Discover Tech sold those ads to mercenary spyware partners, the investigation said. Using platform audience-targeting tools, operators pinpointed victims by location and individual IP addresses.

When a targeted journalist loaded a page, the encrypted ad exploited a vulnerability in Google Chrome. Without a single click, the ad redirected the device to an infected Candiru server and downloaded the spyware.

Google collaborated on the investigation and cut off Discover Tech’s platform access in October. For Candiru, the operation fits a documented commercial pattern. A leaked 2020 presentation showed the company charged 16 million euros to actively hack 10 people at a time using a platform called Sherlock, plus 1.5 million euros for 15 additional targets in the same country, or 6 million euros to expand across five countries.

In 2021, Citizen Lab found Candiru targeted over 100 journalists, activists, dissidents, and politicians, with reported clients across Europe, Russia, the Middle East, Asia, and Latin America.

The US Commerce Department blacklisted Candiru after those revelations, but in 2025, US investment firm Integrity Partners Limited acquired the company and transferred its assets to a new entity not under sanctions.

Researchers warn that micro-targeting everyday ad networks marks a dangerous escalation beyond earlier surveillance tools like Pegasus.

Al Jazeera has condemned the hacks as an attack on press freedom and the public’s right to know, demanding that those responsible be held accountable.