Israeli spyware vendor Candiru, recently blacklisted by the US, waged “watering hole” attacks on UK and Middle East websites critical of Saudi Arabia and others
Lorenzo Franceschi-Bicchierai / VICE :
Context & Ripple Effects
Candiru spent most of 2021 in the spotlight after Microsoft and Citizen Lab documented its two Windows 0-day exploits being used by government hackers across several countries — reporting that preceded the US decision to blacklist the Israeli vendor. This new VICE reporting shows what that tooling was actually pointed at: not high-value device intrusions but watering-hole attacks planted on UK and Middle East websites critical of Saudi Arabia, infecting the sites' own readership.
The story slots into the same arc as the Pegasus investigations, where Citizen Lab traced NSO infections to targets including Downing Street — together they sketch an Israeli export industry whose customers extend well past the regimes its marketing implied.
First-order effects
- Visitors to independent UK and Middle East news sites critical of Saudi Arabia face direct infection risk from their browsers, since the attacks compromise the websites themselves rather than individual targets.
- The US blacklist now formally constrains Candiru's ability to sell into American-aligned markets, even as this reporting shows its capabilities remained deployed against dissident audiences.
Second-order effects
- Other commercial spyware vendors face the same sanction-and-exposure playbook Candiru just went through — research disclosure followed by listing — raising the compliance cost of serving Gulf government clients.
- News organizations and hosting providers in the region inherit a new defensive burden: watering holes make any site critical of Riyadh a potential attack vector, pushing publishers toward hardened infrastructure and traffic filtering.
Third-order effects
- If blacklisting becomes the standard Western response, the commercial spyware market splits between sanctioned vendors serving authoritarian clients and a shrinking pool of legitimate buyers — pressuring Israel's export ecosystem toward consolidation or offshore reconstitution.
- Attack economics shift from device-level 0-days toward cheaper web compromises, which regulators and platform operators are far less equipped to police than app-store or OS vulnerabilities.
The trend: Commercial spyware is moving from bespoke device exploitation toward indiscriminate web-based collection, while US sanctions become the West's main lever against the vendor industry behind it.