Photo illustration. The spyware reached 45 Al Jazeera computers through ads for phones and earbuds.
I worked at Al Jazeera on and off for a long time. I’ve sat in its newsrooms, logged onto its networks, and flew to Doha for the Al Jazeera Forum and dozens of other work events. On Wednesday I learned that Israeli spyware had been sitting inside 45 of the network’s computers, having arrived through banner ads for phones and earbuds, bought on the open market and shown on everyday websites. Nobody had to click. The ad loaded and the computer was taken. Every newsroom security training teaches people to avoid strange links, and that training was useless here.
Researchers call it the first proven case of zero-click spyware spread through targeted ads, and they named the method AdFection. Citizen Lab and Confiant traced it to Discover-Tech, an Israeli ad firm, and to Candiru, a spyware maker based in Tel Aviv. Al Jazeera’s own security team caught the intrusion first, called in Citizen Lab, and handed over its logs. On Thursday the network said it condemns the targeting of its employees’ devices and will keep protecting its staff and systems. Several of the journalists hit, it said, had been reporting on sensitive subjects.
The infections ran through 2024 and 2025. Those were also the years Israel killed at least a dozen of Al Jazeera’s journalists in Gaza. In the same period an Israeli military intelligence unit, which +972 Magazine called the Legitimization Cell, built files casting Gaza reporters as Hamas operatives. Anas al-Sharif was named in those files. The army’s Arabic spokesman attacked him by video. Then Israel killed him in a tent outside al-Shifa hospital, along with his colleagues. While Israel hunted Al Jazeera’s reporters in the field, someone was reading over the shoulders of the people at their desks.
I don’t know whose computers were among the 45. I keep thinking about the people sitting at them. They read the names of their dead colleagues on air, went back to their screens, and typed the next story into a machine someone else was watching.
Citizen Lab has not named the government that bought the operation. Gulf states hacked 36 of the network’s journalists with Israeli Pegasus spyware in 2020, so other governments have gone after the network this way before. Every company in this chain is Israeli, and Israel’s Defense Ministry licenses every foreign sale of this kind of weapon. Israel is the world’s leading exporter of spyware. Of 74 governments known to have bought these tools between 2011 and 2023, 56 bought them from firms based in or tied to Israel. When Washington blacklisted Candiru and NSO in 2021, Israeli officials moved to lobby Washington for their removal, calling the firms critical to Israeli foreign policy. Israel owns this whichever government’s name ends up on the invoice.
Discover-Tech sat on the ad industry’s approved and certified vendor lists and ran its ads through Google, Comcast and Yandex, the same exchanges every major brand uses. It reached more than 120,000 websites and 70,000 apps.
Confiant’s Jerome Dangu told Reuters the firm could reach hundreds of millions of people. Its ads turned up on networks at the Pentagon, NATO, the United Nations, the European Commission, and the International Criminal Court, the same court that issued a warrant for Netanyahu’s arrest. For years the industry let it run because it looked like any other advertiser. The platforms took their cut on every ad.
The US government treats this pipeline as a threat when it touches its own people. After learning that troops in the Middle East were being tracked through commercial ad data, parts of the military switched off ad tracking on their devices. In June the Pentagon’s Defense Intelligence Agency raised Israel’s spying threat against the US to critical, its highest level, after American personnel in Israel reportedly found software on their devices built to tap their communications. The New York Times reported that Israel now rates above every other US ally as a spying threat, and above some adversaries. An Israeli firm used the ad pipeline against a newsroom Israel was bombing, and Washington has announced no response.
Citizen Lab is calling for investigations, and the ICC has standing to examine attacks on journalists covering Gaza. If nobody investigates, the people who ran this face nothing, and the same tools stay on sale to the next government that wants inside a newsroom.