Dozens of journalists working for Al Jazeera were hacked with spyware sold by an Israeli technology firm, in what a watchdog group says is possibly the work of hackers in Saudi Arabia and the United Arab Emirates.

Citizen Lab, a watchdog organization at the University of Toronto, says the phones of 36 Al Jazeera journalists, anchors, producers and executives, as well as a London-based journalist for Al Araby TV, were targeted. Researchers traced the hacks to mobile phone spyware known as Pegasus, which is developed and sold by Israeli-based NSO Group.

The hackers reportedly deployed a so-called “zero-click” attack, likely using the iPhone's iMessage function, the Citizen Lab report says. These interaction-less exploits don’t require victims to click on a suspicious link in order for NSO’s clients to break into their phones.

“The shift toward zero-click attacks by an industry and customers already steeped in secrecy increases the likelihood of abuse going undetected,” said the report, referencing a 2019 WhatsApp attack that targeted at least 1,400 phones through a missed voice call.