Al Jazeera Journalists Hit By Zero-Click AdFection Spyware From Israeli Firms
Researchers found that merely viewing an ad, without clicking, installed surveillance malware on journalists' devices, stealing data and credentials.
Key points
- Al Jazeera journalists were infected with AdFection spyware through a zero-click ad delivery mechanism.
- The operation involved Israeli firms Candiru and Discover-Tech, with Candiru building the surveillance tools.
- The malware harvested files, credentials, audio, video, and messages without any user interaction or click.
Al Jazeera journalists had their devices infected with surveillance malware simply by having an online advertisement displayed on their screens, without clicking it. This zero-click attack allowed attackers to steal sensitive data, including messages and credentials, raising concerns about the scale of potential victims beyond the initial reports.
The risk
The malware, named AdFection by researchers, acts as a powerful infostealer. According to Citizen Lab, the tool harvested files, documents, cookies, bookmarks, and saved credentials from the victims' devices. It also captured keystrokes, took screenshots during work sessions, and accessed microphones and cameras to record audio and video. Email messages and instant messages from various platforms were exfiltrated as well.
Who is exposed
While the confirmed victims are Al Jazeera journalists, the number of affected individuals could be significantly larger. The attack occurred in 2024 when journalists noticed unusual device behavior and contacted the Canadian cybersecurity firm Citizen Lab. The researchers confirmed this as the first known case of zero-click mercenary spyware delivered through online advertisements. The specific buyer of the surveillance tool remains unidentified.
Cost and compliance
The infostealer used in the operation cost several million dollars, according to the researchers. The delivery mechanism and spyware were built by Candiru, a mercenary spyware company that sells surveillance tools to government customers. Candiru has since rebranded as Integrity Labs. The US Department of Commerce blacklisted the company in November 2021 for supplying spyware to governments targeting officials, journalists, and activists.
What should you do?
Teams should monitor for unusual device behavior, such as unexpected resource usage or strange performance issues, which may indicate hidden malware. Organizations should verify the security posture of their ad-tech infrastructure and consider blocking ads from unverified sources. Users should remain vigilant about device anomalies, even if they have not clicked on suspicious links or downloaded files.
The background in plain language
Zero-click attacks exploit software flaws to install malware without any user action, such as clicking a link. Ad-tech infrastructure serves advertisements automatically, creating a potential delivery vector for such exploits. Mercenary spyware refers to surveillance tools sold to state actors or other clients for targeted monitoring. Understanding these concepts helps explain how passive ad viewing can lead to severe data breaches without direct interaction.
Background: Data breaches
Detect breaches by establishing a strict baseline of normal network and user behavior. Monitor for impossible travel, unusual data egress volumes, and command-line activity. Correlate these signals across identity, endpoint, and network layers to catch stealthy exfiltration.
Read the full guide: Detect Data Breaches: Hidden Signals in Logs and System Behavior
What to do and how to stay safe: AdFection
- Monitor device performance for anomalies that could indicate hidden surveillance software or data exfiltration.
- Review ad-serving configurations to minimize exposure to unvetted third-party advertising networks and scripts.
- Implement strict endpoint detection and response tools to identify unauthorized access to cameras, microphones, or keystrokes.
- Educate staff on the risks of zero-click threats and the importance of reporting unusual device behavior immediately.
Step-by-step guide: Mobile Security Architecture: 8 Practices for Device Integrity
General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is AdFection?
AdFection is a zero-click mercenary spyware attack that infects devices through online ads without requiring user interaction.
Which companies were involved in the AdFection operation?
The operation involved Israeli firms Candiru (now Integrity Labs) and Discover-Tech, with Candiru building the spyware.
Who were the confirmed victims of the AdFection attack?
Al Jazeera journalists were confirmed victims, though the total number of affected individuals may be higher.
