It's being reported today that dozens of journalists at Al-Jazeera, the Qatari state-owned media company, have been targeted by advanced spyware in an attack likely linked to the governments of Saudi Arabia and the United Arab Emirates, a cybersecurity watchdog reported.

Citizen Lab at the University of Toronto said it traced malware that infected the personal phones of 36 journalists, producers, anchors and executives at Al-Jazeera back to the Israel-based NSO Group, which has been widely condemned for selling spyware to repressive governments.

Most unnerving to the investigators was that iMessages were infecting targeted phones without the users taking any action - what’s known as a zero-click vulnerability. Through push notifications alone, the malware instructed the phones to upload their content to servers linked to the NSO Group, Citizen Lab said, turning journalists’ iPhones into powerful surveillance tools without even luring users to click on suspicious links or threatening texts.

Apple said it was aware of the Citizen Lab report and said the latest version of its mobile operating system, iOS 14, “delivered new protections against these kinds of attacks”. It sought to reassure users that NSO doesn’t target the average iPhone owner, but rather sells its software to foreign governments to target a limited group. Apple has not been able to independently verify Citizen Lab’s analysis.

Last year, WhatsApp and its parent company Facebook filed an unprecedented lawsuit against the NSO Group, accusing the Israeli firm of targeting some 1,400 users of its encrypted messaging service with highly sophisticated spyware through missed calls. For more, read the full SCMP report.