Governments turn digital ads into invisible zero-click spyware

A fresh investigation by digital rights watchdog Citizen Lab has revealed that governments are weaponising mainstream online advertising infrastructure to distribute potent spyware. According to the findings, dozens of devices at international news organisation Al Jazeera were successfully breached simply after being served malicious advertisements, removing the traditional requirement for a victim to interact with a compromised link.

This method represents a chilling evolution in surveillance tactics. For years, cyber defence training has focused on teaching staff to spot phishing emails and avoid suspicious downloads. Zero-click exploits delivered via ad networks completely bypass that human line of defence. By embedding malicious exploit payloads inside programmatic ad units, attackers can silently target vulnerabilities in browsers or operating systems the exact moment an advertisement loads in the background.

The vulnerability of programmatic advertising

The incident highlights the systemic risks baked into the modern ad-tech ecosystem. Online advertising relies on sprawling, automated real-time bidding exchanges that handle billions of impressions across millions of websites every day. Because digital publishers rarely have complete visibility over every snippet of code served by third-party ad networks, hostile actors can slip exploit code into legitimate web traffic with remarkable ease.

While high-end spyware operations are typically aimed at high-profile targets like journalists, activists, and political figures, the underlying attack vector affects the wider internet. When threat actors successfully weaponise the plumbing of ordinary commercial web services, the collateral risk quickly trickles down to ordinary enterprises relying on standard web browsers for day-to-day work.