Citizen Lab Documents Government Exploitation of Online Ads to Deploy Zero-Click Spyware
Citizen Lab, a digital rights research unit, has published findings detailing how government actors leveraged online advertising networks as an attack vector to deploy sophisticated spyware against targets.
The technique, analyzed in depth by the researchers, targeted devices at Al Jazeera, a major international media organization. What makes this attack vector particularly concerning is its "zero-click" nature—meaning the spyware was deployed without requiring the victim to click on any link, download any file, or take any action whatsoever.
By injecting malicious code into online advertisements served through legitimate ad networks, attackers were able to exploit vulnerabilities in devices simply through the normal process of loading a webpage. This approach takes advantage of the pervasive nature of online advertising, making it difficult for potential targets to avoid exposure while using standard web browsing.
The research highlights ongoing concerns about the commercialization of surveillance tools and the creative vectors through which state-sponsored actors increasingly target journalists, activists, and other individuals of interest. Zero-click exploits have emerged as a particularly valuable capability for government hacking operations due to their ability to compromise targets without leaving obvious traces or requiring victim cooperation.
Citizen Lab's documentation of this campaign adds to growing evidence that advertising infrastructure—typically viewed as a privacy and security concern for users—can also be weaponized by sophisticated adversaries with significant resources.