How many Al Jazeera devices were infected by the Candiru-linked spyware?

Al Jazeera says the covert malware campaign infected 45 devices belonging to its journalists and staff.

Did users have to click anything for the spyware to infect their devices?

No. Al Jazeera described it as a zero-click attack where the malware exfiltrated data without any user interaction, meaning no one had to open a file, tap a link, or approve anything.

How does zero-click spyware work without any user action?

It exploits flaws in software that automatically processes incoming data, such as messaging apps, media parsers, or network services, so a specially crafted message or data packet can trigger code execution before the owner sees anything.

Al Jazeera Says Candiru-Linked Spyware Hit 45 Staff Devices

Q: What is Candiru?

Candiru is described as an Israeli firm whose tools are often called mercenary spyware—powerful surveillance capabilities developed by private vendors and sold to clients.

Q: Why are journalists prime targets for spyware like Candiru's?

Reporters hold sensitive material such as source identities, unpublished findings, and private communications, so compromising a newsroom's devices can expose all of that at once.

Al Jazeera says a covert malware campaign linked to the Israeli firm Candiru infected 45 devices belonging to its journalists and staff, and pulled data from them without any action by the users. The disclosure is a stark example of how zero-click spyware journalists rely on can be turned against them, and why ordinary caution is often not enough against well-funded attackers.

The details below come from a report summarizing Al Jazeera's statement. Where the public record is thin, we say so.

What Al Jazeera Says Happened

According to the report, Al Jazeera described a zero-click attack tied to Candiru that compromised 45 of its journalists' devices. The malware reportedly exfiltrated data without any user interaction. In other words, the people affected did not need to open a file, tap a link, or approve anything for the infection to take hold.

The source summary does not provide further specifics, such as which operating systems were affected, which vulnerabilities were used, over what period the infections occurred, or who commissioned the campaign. We are not going to guess at those details. Readers should treat the 45-device figure as Al Jazeera's reported claim and watch for technical follow-up from the broadcaster or independent researchers.

How Zero-Click Spyware Works Without Any Tap

Most people have learned to avoid suspicious links and unexpected attachments. That advice targets "one-click" attacks, where a victim has to do something. Zero-click spyware removes that step.

In general terms, zero-click attacks take advantage of flaws in software that automatically processes incoming data, such as messaging apps, media parsers, or network services. If an attacker finds a vulnerability in that automatic handling, a specially crafted message or data packet can trigger code execution on the phone or computer before the owner sees anything. There may be no notification, no strange pop-up, and no obvious sign afterward.

Once installed, spyware of this kind can typically be used to read messages, collect files, and gather other data from the device. Al Jazeera's report of data exfiltration fits that pattern.

The key point for non-technical readers: this is not a failure of user judgment. Careful behavior cannot fully prevent an attack that requires no behavior at all.

Why Journalists Are Prime Targets for Candiru-Style Tools

Candiru is described as an Israeli firm, and tools from companies like it are often called mercenary spyware: powerful surveillance capabilities developed by private vendors and sold to clients. These tools are expensive and complex to build, which is why they tend to be aimed at a small number of high-value targets rather than the general public.

Journalists fit that profile for clear reasons. Reporters hold sensitive material: source identities, unpublished findings, and private communications with people who may be at risk. Compromising a newsroom's devices can expose all of that at once. A single infected phone can reveal not just the journalist's own activity but the contacts and confidences of everyone they speak with.

The scale reported here, 45 devices at one organization, suggests a campaign aimed at a whole institution rather than one individual. That matters for news organizations, human rights groups, and any workplace where several people handle sensitive information.

Surveillance pressure on reporting also shows up in other forms. Our coverage of the prolonged internet blackout in Pakistani-administered Kashmir, drawing on Al Jazeera reporting, shows how restrictions on communication can compound the risks people face when trying to share information.

What Realistically Reduces Your Exposure

No single step makes a device immune to a determined, well-resourced attacker. But some measures meaningfully raise the cost and difficulty of an attack.

Install OS and app updates promptly. Zero-click attacks depend on unpatched or undisclosed flaws. Security updates close known holes, and delays leave them open.
Enable Lockdown Mode where available. Some platforms offer an extreme protection setting that reduces the attack surface by limiting certain features. It trades convenience for security, which can be a reasonable bargain for people at elevated risk.
Restart devices regularly. Some malware does not survive a reboot, so periodic restarts can force an attacker to reinfect.
Reduce what is stored on your device. Disappearing messages and routine deletion limit how much an intruder can collect.
Separate sensitive work. Using a dedicated device for the most sensitive communications can contain the damage if another device is compromised.
Report suspected compromise. If you work at a news organization or advocacy group, raise concerns with your security team or a digital security specialist rather than trying to investigate alone.

What This Means For You

Most readers are unlikely to be targeted by tools like Candiru's. But the lessons apply broadly. Keeping devices updated is the single most useful habit, and it protects against many other threats as well.

If you are a journalist, activist, lawyer, or someone else who may attract state-level interest, assume your risk is higher and act accordingly: update quickly, use the strongest protection modes your device offers, and limit sensitive data on your phone.

It is also worth being clear about what a VPN does and does not do. A VPN encrypts your network traffic and masks your IP address from sites and local networks. It does not stop spyware that is already running on your device, and it cannot prevent a zero-click exploit that targets software on the phone itself. VPNs remain useful for network privacy, but they are not a defense against this class of attack.

Key Takeaways

Al Jazeera's reported disclosure of a Candiru-linked campaign against 45 devices is a reminder that zero-click spyware journalists face can bypass even careful users. Treat the details as developing, since the public summary is limited.

For anyone at higher risk: apply OS updates as soon as they are available, turn on Lockdown Mode if your device supports it, restart regularly, store less sensitive data, and understand that a VPN will not protect you from spyware on the device itself.