Zero-Click Phone Hacking Explained

Your phone can be hacked without you clicking on anything at all.

You just have to scroll past an ad on your timeline, and it's enough.

Spyware attaches itself to your phone, records your screen, your

passwords, uploads your private data to a hacker

miles away.

How do I know this? Because it happened to us.

For the last year, Al Jazeera has been working with Citizen

Lab to investigate

how two Israeli companies hacked into more than 45 devices

right here. It's the first time this kind of hack,

a so-called

zero-click ad hack, has been revealed, and what it means for not just

journalists, but all of us, is pretty chilling.

In 2025, Al Jazeera's technology team began to

notice some strange

patterns on some of our journalists' devices.

What they found was Trojan malware, software hiding inside their laptops

that was recording their keystrokes, taking screenshots, and sending them to

external servers. Someone was trying to find out what they

were working on.

The spyware was developed by the Israeli company Candiru, and it works in a

way that's hard to detect. It collects information from specific ads

that appear

on normal websites. If you scroll past the ad, or even

if the ad loads

in the background, that's enough.

It redirects you to an infected server belonging to Candiru, which downloads

the malware onto your device and begins collecting data

and sending it back to

the server. But how do these secret ads appear?

How do they find you?

That's where the second Israeli company, DiscoverTech, comes in.

Because it presents as a legitimate advertising firm, it's been able to buy up

ad space on a number of websites and social media platforms.

What it's really doing is selling these ads to mercenary spyware

partners, the

companies that develop these Trojan bugs.

It uses audience targeting tools on these platforms to pinpoint potential

victims by location. It can even target ads to individual IP

addresses. This is how the hackers were able to find Al Jazeera staff and

run these encrypted ads directly to them.

And again, no one had to click on any of the ads.

All they had to do was load them. But DiscoverTech was able to exploit a

vulnerability in Google Chrome. Google actually collaborated on this

investigation, and in October, removed DiscoverTech from its platform

and cut off its access. In 2020, a leaked commercial presentation for

Candiru showed the company was charging 16 million euros to

actively hack 10 people at a time using a platform called Sherlock.

Following these revelations, the US Commerce Department blacklisted

Candiru,

saying it sold spyware to foreign governments that used the equipment to

target government officials, journalists, and others.

But in 2025, Candiru was acquired by a US investment firm

called Integrity Partners Limited, and its assets were transferred to a new

entity not under sanctions. Al Jazeera worked closely with Citizen Lab

to

bring this important story to light and has condemned the targeting of its

staff.

In a statement released, it says simply this,

"The targeting of journalists is an

attack on press freedom and on the public's right to know.

Those responsible must be held accountable." If you're not safe from the

ads on

your phone, the ones you usually ignore anyway,

that means that protecting

yourself and your personal data has now become much harder.