An opinion piece published by The New Arab argues that Al Jazeera is the latest target of Israeli spyware that weaponises digital ads for surveillance, and that the attack is just the tip of the iceberg. The author, Silverstein, frames the case as a warning for everyone, not only newsrooms. The source text we have is brief, so this post sticks to what it states and uses our earlier reporting to explain the practical side. If you want solid ad-delivered spyware protection, the Al Jazeera case is a useful place to start.

How Malicious Ads Deliver Spyware

Most of us were taught one rule: don't click suspicious links. Ad-delivered attacks challenge that rule, because the ad itself becomes the delivery route. Our reporting on zero-click spyware ads targeting journalists describes spyware infecting devices through ads people never clicked.

In plain terms, a web page or app loads ads from third-party networks. If an attacker can place a malicious ad into that supply chain, and the device has a flaw the ad can exploit, the device can be compromised just by loading the content. The user does not have to tap, download, or approve anything. That is what "zero-click" means.

The same reporting is covered in more depth in our piece on AdFection, the zero-click ad spyware journalists faced in 2024, which notes that Al Jazeera and Citizen Lab have both documented the activity.

What the Al Jazeera Attack Shows

According to our earlier coverage, Al Jazeera says a covert malware campaign linked to the Israeli firm Candiru infected 45 devices belonging to its journalists and staff, and pulled data from them without any action by the users. You can read the details in our report on the Candiru-linked spyware that hit 45 staff devices.

The opinion piece draws a broader conclusion: if digital advertising can be turned into a surveillance channel against a major news organisation, the same technique is not limited to that target. We should be careful here. This is an opinion argument, and we cannot confirm from the source how widely the method has been used beyond the documented cases. But the underlying point is technically sound. Ad networks reach enormous numbers of ordinary devices, and any weakness in that chain is a risk shared by many people.

The case also fits a wider pattern of commercial spyware use. Our coverage of ICE confirming its use of Paragon Graphite spyware shows that these tools are sold to and used by government agencies, which keeps demand and development active.

What Ordinary Users Can Do to Reduce Risk

Most people are unlikely to be the target of a state-grade campaign. Still, a few habits meaningfully cut exposure.

  • Keep devices updated. Ad-based exploits typically depend on unpatched flaws in browsers and operating systems. Install updates promptly, and turn on automatic updates.
  • Use a reputable ad blocker. If the malicious content never loads, it cannot run. Blocking ads reduces the number of third-party sources your browser talks to.
  • Enable lockdown features. Apple's Lockdown Mode, for example, is designed to shrink the attack surface for people who may face targeted threats. Android and some browsers offer stricter security settings too. Expect some features to work less smoothly.
  • Restart regularly. Some infections do not survive a reboot, so periodic restarts can disrupt them.
  • Limit what runs in the background. Remove apps you don't use, since each one can load its own ads and content.

If you are a journalist, activist, or work with sensitive sources, treat these steps as a baseline and seek help from a digital security organisation.

Where a VPN Helps and Where It Doesn't

A VPN encrypts your traffic between your device and the VPN server, and hides your IP address from the sites you visit. That is useful on public Wi-Fi and for limiting some tracking by your network provider.

What a VPN does not do is stop an exploit that arrives inside content your device legitimately requests. If a malicious ad loads in your browser, the VPN carries it to you like any other data. A standard VPN will not patch a software flaw or remove spyware already on your phone.

Some VPN services add optional DNS-level blocking of known ad and tracker domains, which can reduce exposure. That is a filtering feature, not a core VPN function, and it will not catch everything. Think of a VPN as one privacy layer, not a defence against zero-click attacks.

What This Means For You

The old advice to avoid suspicious links still matters, but it is no longer enough on its own. Your protection now depends heavily on how current your software is and how much untrusted content your devices load. You don't need to panic. You do need to treat ad-delivered spyware protection as a routine part of device care, not something reserved for newsrooms.

Takeaways

  • Turn on lockdown mode or equivalent strict settings if you handle sensitive work.
  • Keep your operating system, browser, and apps updated.
  • Install a reputable ad blocker and review your browser extensions.
  • Use a VPN for network privacy, but don't rely on it to stop ad-based exploits.
  • For deeper reporting on the campaign, read our articles on the Candiru-linked Al Jazeera infections and zero-click ad spyware.

Strong ad-delivered spyware protection comes down to a few consistent habits: update, block, and harden your devices.