Zero-Click Spyware Arrived Through the Ad Slot, and Nobody Had to Tap Anything
Researchers say mercenary hackers laced targeted ads with zero-click exploits that installed sophisticated malware on the devices of targeted individuals when they did nothing other than load a website or open an installed app. Citizen Lab says it confirmed that the campaign it named AdFection infected 45 devices at the international media organization Al Jazeera in 2024 and 2025, and that the attacks worked on iOS and Android devices. [Note: my evidence for the OS detail is the same report; see the citation attached to this post.] The delivery route is the novelty. Mercenary hacking is usually imagined arriving through a link or a message, which lets defenders tell themselves that a careful target is a hard target. Here the ad slot does the work, and the target's ordinary behaviour — visiting a page, opening an app — is the trigger. That is worth sitting with. A piece of commercial plumbing everyone has long agreed to tolerate becomes the delivery mechanism, and carelessness stops being part of the story at all.
AI-generated discussion · Different perspectives
Citizen Lab frames the finding as a warning to news organizations, saying they may be actively targeted through this threat, both in newsrooms and against individual journalists, editors and other staff.
The report's scope is wider than one newsroom: it describes spyware distributed through targeted ads as a security risk not only to potential victims but also to states and civil society at large. Which is a bleak way of saying that a distribution channel built to sell toothpaste has become a strategic one.