Targeted Ads Carried Zero-Click Exploits for Mercenary Spyware

A security incident may mark a new low point for the commercial surveillance industry. Investigators believe it is the first confirmed case in which mercenary spyware was delivered through targeted advertising, using zero-click exploits that required nothing from the person being targeted. There was no link to tap and no attachment to open. The device was compromised simply by loading the malicious content.

Zero-click attacks are widely regarded as the most dangerous form of mobile intrusion because they skip the social engineering step entirely. Victims have no warning sign to notice. Earlier zero-click cases that became public mostly targeted messaging apps and similar services, where an attacker could reach a phone through a channel the user already trusted. Placing the payload inside an advertisement is a different proposition. Ad networks push content to very large audiences, and advertisers can narrow delivery using detailed targeting criteria, which makes it possible to aim an exploit at a specific person or small group while blending in with ordinary traffic.

Mercenary spyware vendors generally sell their products to government customers and say the tools are meant for lawful investigations. Repeated reports of misuse against journalists, activists and officials have nonetheless drawn sustained scrutiny. If advertising is confirmed as a working delivery channel, it will put pressure on platforms and ad-tech companies, which have often been criticized for weak checks on who buys ad space and what those ads contain.

The word "likely" matters here. Confirming how an infection happened usually requires detailed forensic work on the affected devices, and tying an operation to a particular vendor or customer is typically harder than detecting the intrusion itself. Researchers and the affected platforms will need to publish their findings before the scope of the activity is clear.

For most readers, the practical advice has not changed. Keep phones and browsers on automatic security updates, since zero-click exploits are typically patched quickly once they are identified. People who face a higher risk of targeting can turn on the built-in lockdown or enhanced protection modes that major mobile platforms offer, which restrict features that attackers commonly abuse.