CSAIS
IDEN
CriticalEarly warningMalwareIsrael · English

Citizen Lab Says Spyware Was Delivered Through Targeted Online Ads

First seen 15 Oct, 17:00 WIBLatest 17 Oct29 articles · 26 publishers · 1 syndicated
victim: al jazeeraVerify evidence
86
Confidence index · preliminarycomputed by the pipeline (V0.7)high
Corroborated by distinct domains
Independent sources
Victim identified
Full text available
Clustering consistency
Status and preventive steps
Early warningMachine output from news coverage; not verified by the public or institutions
Preventive steps
  • Apply least-privilege access, back up data, and train staff to spot phishing.
  • Install apps only from official stores and never open APK files sent over chat.
  • Keep the operating system and apps updated and leave built-in protection on.
Literacy audienceAndroid users in IndonesiaiPhone users in IndonesiaExecutives and managers
Literacy topics
  1. System updates and security patches
  2. The danger of APK files and unofficial apps
  3. How to report and keep evidence

Report toPatroli Siber Polri

Extracted claims

Victimconfidence 0.90
Al Jazeera
Actornot found
not identified
Attack typeconfidence 0.90
Malware4 differing values across articles; review needed.
Event dateconfidence 0.50
2026-09-01
LocationIsrael
Target groupBusinesses
Status
  • D1 Machinehigh trust
Conclusion
  • D1 MachineHappened

Source chronology

29 articles, by publication time

15 October 202610 articles

  1. 17:00 WIBFirst reportfull text hashed
    ‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Adswired.comAl Jazeera
  2. 17:00 WIB+0 h
    Israeli Firms Placed Spyware at Al Jazeera via Ads, Report Saysbloomberg.com
  3. 17:00 WIB+0 h
    Israeli ad company helped a spyware firm target Al Jazeera through online ads, researchers saynbcnews.com
  4. 18:20 WIB+1 h
    Israeli firms placed spyware in devices at Al Jazeera by manipulating online ads—Canada watchdog reporttheprint.in
Show all 29 articlesCollapse

15 October 2026 · continued10 articles

  1. 19:31 WIB+3 h
    Israeli Ad Firm Helped Spyware Target Al Jazeera: Reportenglish.punjabkesari.com
  2. 20:25 WIB+3 h
    Discover-Tech Spyware Ads Hit 45 Al Jazeera Devices [2026] - tech-insider.orgGoogle News
  3. 22:26 WIB+5 hfull text hashed
    Israeli spyware targeted 'hundreds of millions' through zero-click ads, researchers findmiddleeasteye.netAl Jazeera
  4. 23:07 WIB+6 h
    Citizen Lab Says Spyware Was Delivered Through Targeted Online Adsandroidpure.com
  5. 23:32 WIB+7 hfull text hashed
    Report: Israeli ad-tech firm enables spyware targeting of at least 45 Al Jazeera devicescpj.org
  6. 23:46 WIB+7 hfull text hashed
    Online ads infected targets with Candiru spyware in zero-click attackscyberinsider.comAl Jazeera

16 October 202618 articles

  1. 00:40 WIB+8 h
    Israeli Ad Firm Helped Spyware Target Al Jazeera, Citizen Lab SaysThe Eastern Herald
  2. 01:05 WIB+8 hfull text hashed
    Zero-Click Spyware Delivered Through Online Ads Infected Al Jazeera Devices, Researchers Sayfinance.biggo.com
  3. 01:17 WIB+8 hfull text hashed
    Citizen Lab Says Israeli Discover Spyware Targeted 45 Al Jazeera Windows Devices: how 14 outlets framed itnewscord.org
  4. 01:52 WIB+9 hfull text hashed
    Google Cuts Off an Israeli Ad Vendor After Researchers Tie Its Targeted Ads to Zero-Click Spyware Infectionsnews.ssbcrack.comAl Jazeera
  5. 01:54 WIB+9 h
    Israeli ad-tech firm helped place spyware on Al Jazeera devicesaljazeera.com
  6. 03:29 WIB+10 hfull text hashed
    Targeted Ads Used to Infect Al Jazeera Devices with Candiru Spywarehackread.com
  7. 04:05 WIB+11 h
    Israeli ‘ad’ firm helped infect spyware into Al Jazeera devicesaljazeera.com
  8. 07:35 WIB+15 hfull text hashed
    Candiru spyware: Malicious ads targeted NATO, UN and Al Jazeeramodernghana.com
  9. 08:20 WIB+15 hSyndicatedfull text hashed
    Candiru spyware: Malicious ads targeted NATO, UN and Al Jazeeramodernghana.com
  10. 11:55 WIB+19 h
    Israeli Firm Faces Google Ban After Planting Zero-Click Spyware on Al Jazeera Devicessofx.com
  11. 12:30 WIB+20 h
    Israeli firms put spyware at Al Jazeera via ads, report saysthestar.com.my
  12. 12:50 WIB+20 h
    Zero-Click Spyware Infects 45 Al Jazeera Devices Through Malicious Online AdsCyber Press
  13. 15:30 WIB+23 h
    Citizen Lab Says Targeted Ads Delivered Zero-Click Spyware to Al Jazeeratechnology.org
  14. 18:44 WIB+26 h
    AdFection Zero-Click Spyware Attack Hits Al Jazeeraesecurityplanet.com
  15. 19:45 WIB+27 hfull text hashed
    Israeli spyware firms allegedly hacked Al Jazeera computers through online advertisementsazernews.az
  16. 20:03 WIB+27 h
    You Didn’t Even Click: Researchers Uncover Spyware Delivered Through Adsallaboutcookies.org
  17. 21:06 WIB+28 h
    Candiru spyware infects Al Jazeera, Senators AI request, Microsoft crashes phisherslinkedin.com
  18. 21:20 WIB+28 hfull text hashed
    Israeli Firm Used Targeted Ads to Infect Al Jazeera Devices with Zero-Click Spywaredemocracynow.org

17 October 20261 articles

  1. 04:16 WIB+35 h
    How Israeli spyware used ‘zero click’ hack on Al Jazeera staffaljazeera.comAl Jazeera
Relations between articles
385 pairs likely independent19 pairs uncertain1 pairs possibly reproduced1 pairs likely duplicate

Evidence

Hashes prepared29full text hashed 12
first evidence_uid4b6a71e40c412bdfe6f19ac3
29 of 29 evidence records are in Merkle batches

Flow comparison D1–D4

each flow's preventive output; this is where they differ · D1 changed 2 times · since 16 Oct
D1Machine17 OctD2Public surveynone yetHelp reviewD3Institutionnone yetD4Official recordnone yet
Literacy audienceAndroid users in IndonesiaiPhone users in IndonesiaExecutives and managers–––
Literacy topics
  1. 1.System updates and security patches
  2. 2.The danger of APK files and unofficial apps
  3. 3.How to report and keep evidence
–––
Preventive steps
  • Apply least-privilege access, back up data, and train staff to spot phishing.
  • Install apps only from official stores and never open APK files sent over chat.
  • Keep the operating system and apps updated and leave built-in protection on.
Report to Patroli Siber Polri
–––
Institution's reason––––

Columns D2 to D4 fill in once the public survey and institution statements are running.Summary across incidents