Zero-Click Spyware Ads: What Newsrooms Need to Know
See how targeted ads reportedly delivered zero-click spyware, why the adtech chain matters, and practical steps newsrooms can take to reduce risk today.
When an Ad Becomes an Exploit: The New Zero-Click Spyware Risk
A mobile ad is usually treated as a nuisance, a privacy concern, or - at worst - a bad link. A new investigation from the University of Toronto's Citizen Lab argues that the stakes can be higher: under some conditions, an ad can help deliver mercenary spyware without the targeted person ever tapping or clicking.
Citizen Lab says a campaign it calls AdFection infected 45 devices belonging to staff at international media organization Al Jazeera during 2024 and 2025. The reported attacks worked on both iOS and Android. In Citizen Lab's account, a device could be compromised just by opening an app or loading a website that served the relevant ad. That shifts the security question from "Did someone click the bad link?" to "What happens inside the ad systems that decide what reaches a specific phone?"
This article breaks down what the report claims, how targeted ads can end up as part of an exploit chain, and what the findings do - and don't - prove. It also covers practical steps newsrooms and other high-risk organizations can take. The goal isn't to suggest that every ad is dangerous. It's to treat ad delivery as part of the attack surface and plan accordingly.
What Citizen Lab says happened
Citizen Lab describes AdFection as a campaign that used targeted advertising to deliver zero-click exploits and install spyware on selected mobile devices. It says it confirmed infections on 45 devices associated with Al Jazeera in 2024 and 2025. In the reported cases, targets were exposed during normal behavior: opening an app or loading a website that displayed an ad.
The distinction between zero-click and a conventional phishing attack matters. Phishing asks a person to do something - open an attachment, follow a link, or enter credentials. A zero-click exploit can run without that step. That means the person may never see a warning and may not notice anything odd. It also removes one of the defenses organizations often lean on: training staff to recognize suspicious messages.
Citizen Lab also frames the incident as the first confirmed case of mercenary spyware delivered through targeted ads. That's a strong claim, but it needs to be read carefully. It's about the reported campaign and the evidence Citizen Lab presents - not proof that all targeted advertising works this way, or that every ad platform is involved. The report focuses on a specific advertising intermediary and its role in the spyware ecosystem described in the investigation.
What "zero-click" means in practice
"Zero-click" doesn't mean attackers can compromise any phone at any time. An exploit still depends on technical conditions: the device, the software version, the vulnerable component, the targeting rules, and the exploit chain all have to line up. In this context, the "zero" part means the target doesn't need to take an explicit action like clicking a link.
That's part of why these incidents are hard to spot from everyday user behavior. If nothing obviously suspicious happens on-screen, a person may not remember any trigger. Detecting an infection may require specialist forensic tools, plus access to the device or relevant records. Restarting a phone, deleting an app, or checking browser history can't be relied on to confirm that a device is clean.
The role attributed to Discover-Tech
Citizen Lab says the ads were supplied by Discover-Tech, an Israeli company that presents itself as an advertising business. According to the researchers, Discover-Tech brokers connections between advertisers and publishers or app makers, while also facilitating activity for multiple mercenary spyware partners. Citizen Lab describes it as a bridge between ad vendors and the mercenary spyware ecosystem.
The report says Citizen Lab obtained more than 4 billion bidding records associated with Discover-Tech. In those records, Citizen Lab reports that Discover-Tech's ads appeared in more than 70,000 mobile apps and over 120,000 websites between March and June 2026. Those figures describe the scale of ad delivery visible in the records. They do not mean billions of people were infected, and they don't mean every listed app or website knowingly participated in spyware delivery.
For the full reporting, see Ars Technica's coverage of the Citizen Lab investigation. The key distinction is between the "reach" of an ad network and the number of confirmed victims. The report identifies 45 infected devices at one media organization; it does not establish a global infection count.
How targeted advertising can become an attack channel
Digital advertising isn't a simple one-to-one exchange between an advertiser and a website. Ads can move through brokers, exchanges, supply-side platforms, app developers, publishers, and other intermediaries before they land on a device. In many systems, an automated auction selects an ad impression in milliseconds. Campaigns can target specific audiences or contexts, and the systems use data signals to decide which impressions are likely to perform.
Citizen Lab says Discover-Tech's bidding process used signals including unique mobile advertising IDs, location, IP addresses, and other data points. Taken together, those signals can help build detailed profiles and differentiate devices or audiences. In the reported campaign, the core concern isn't only that ads were personalized. It's that targeted delivery could make parts of the ad infrastructure useful for reaching specific people with exploit-bearing content.
The difference between ad targeting and exploitation
Targeted advertising alone isn't a zero-click exploit. Most ads are ordinary commercial content, and most ad impressions won't compromise a device. The security issue shows up when a malicious (or specially crafted) ad is tied to an exploit that takes advantage of a software weakness. The ad can act as the trigger or delivery mechanism, while other parts of the chain handle identifying the target and carrying out the installation attempt.
That separation matters in practice. Blocking all ads may reduce some exposure, but it isn't a complete strategy. Staff still use many apps and websites, and ad delivery can be embedded in services an organization doesn't control. Even on a well-managed device, third-party content can appear through a browser or a legitimate app.
In theory, an organization might try to restrict a handful of websites. In practice, the supply chain is wide, changes quickly, and is hard to map fully. A more durable approach is to reduce the harm that follows compromise, limit unnecessary data collection, keep devices updated, and build a process for investigating credible warnings.
Why the data trail matters
The same identifiers that help ad systems decide what to show can also create privacy and security risks when they're used to single out people. Location data, network information, and persistent device identifiers can support profiling. Combined, they may also help narrow delivery to specific individuals or groups. That's why the risk is both technical and organizational: more data can make targeting more precise, while a complicated supply chain makes accountability harder to establish.
The reported volume of bidding records is another reason not to dismiss this as abstract. Adtech can generate large amounts of data about where and when a device receives ads. But record volume by itself isn't evidence that every record includes a complete personal profile - or that a specific person can always be identified. Organizations still shouldn't assume an ad impression is anonymous just because it shows up in a free app or on a public site.
Why the risk is different for newsrooms
Journalists and media organizations can be attractive targets because their work can involve sensitive sources, unpublished reporting, internal communication, and contact with people who may face serious consequences if exposed. A compromised phone can potentially provide access to communications and personal information, depending on what the spyware can do and how the device is configured. Citizen Lab's material doesn't spell out the malware's full capabilities, so it would be wrong to claim every infected device exposed the same data.
Citizen Lab's warning is aimed at organizations and at individual journalists and staff. That distinction is important: attacks may target a person rather than a newsroom's central systems. A company firewall or a managed email account won't necessarily help if a reporter's personal phone - used for travel, source contact, or access to work services - becomes the target.
Why standard awareness training is not enough
Teaching people not to click suspicious links still matters for phishing and other common attacks. But it doesn't address exploits that don't require user interaction. If organizations treat "don't click" as the main defense, it can create a false sense of security - and then set up victims to be blamed for an attack they couldn't realistically prevent.
The response needs controls beyond day-to-day user behavior: mobile-device management, timely software updates, extra care for higher-risk devices, stronger account security, and a dependable incident-response process. None of that makes exploitation impossible. It does improve the odds of preventing an attack, limiting what attackers can access after compromise, and responding before damage spreads.
What the investigation does not establish
Security planning works best when you separate what's confirmed from what's still open. Based on the reporting available to the public, Citizen Lab confirmed 45 infected devices at Al Jazeera and identified Discover-Tech's role in the ad-delivery chain. The research points to a broader concern for news organizations.
But the source material doesn't provide the names of the spyware partners, the technical details of the exploit chain, the specific vulnerabilities used, or a complete list of affected individuals and apps. It also doesn't show that every ad served by Discover-Tech included an exploit. Those gaps matter: they limit what outside observers can independently verify and make it risky to turn this reporting into claims about specific products, platforms, or the scope of infections beyond what researchers described.
Uncertainty shouldn't be treated as permission to ignore the issue. It should push organizations away from guesswork. If targeting is plausible, preserve relevant information and seek qualified forensic support rather than relying on improvised checks or public malware scans.
What organizations can do now
No single control can stop every zero-click attack. The practical goal is to make targeting harder, reduce what's exposed on a device, and ensure that a suspected compromise can be handled quickly. A good starting point is to split the work into prevention, exposure reduction, and response.
1. Reduce exposure on high-risk devices
- Keep operating systems and applications updated, and make update installation part of device policy rather than an occasional reminder.
- Use supported devices with a clear security-update path. A phone that no longer receives updates is harder to defend against newly discovered vulnerabilities.
- Review which apps have access to location, contacts, microphone, camera, and other sensitive data. Remove permissions that aren't needed for the app's function.
- If possible, separate high-risk reporting activity from general browsing and personal app use. This doesn't eliminate compromise, but it can limit how much information is exposed in one place.
- Consider high-security modes for staff facing elevated threat levels. For example, Apple's Lockdown Mode documentation describes a protection option designed for people who may face highly targeted attacks. Such modes can restrict functionality, so weigh the trade-offs and don't assume one setting guarantees safety.
2. Treat advertising and tracking as part of the attack surface
Organizations should map which apps and services staff use for work, what data those services collect, and whether mobile advertising identifiers are genuinely necessary for business needs. Where device management allows it, reduce unnecessary tracking and limit ad-related permissions or identifiers in line with what each platform supports.
Ad blockers and content restrictions can reduce exposure to some unwanted content, but they shouldn't be treated as the main fix. They may not cover every app, ad format, or delivery route, and they can interfere with legitimate services. Test changes before rolling them out across the newsroom. If staff work around the control because it disrupts reporting, it's not reliable.
For staff at higher risk, write clear guidance on which devices and accounts should be used for sensitive source communication. That guidance has to reflect real working conditions - travel, breaking news, and personal devices. A policy that only exists on paper won't help anyone in the field.
3. Prepare for forensic investigation
Because zero-click activity may leave little to nothing that an average user can recognize, decide in advance how staff should report a concern and who can authorize a forensic review. Preserve the device and relevant context when possible. Don't casually wipe, reset, or replace a suspected phone before specialists advise - those actions can destroy evidence that could clarify what happened.
Your response plan should include:
- A named security contact and a way to submit urgent reports outside normal business hours.
- A process to assess risk to sources, colleagues, and accounts connected to the device.
- Access to independent mobile forensic expertise appropriate to your threat profile.
- A decision path for containment, account recovery, device replacement, and notification.
- A way to record what's known, what's suspected, and what's still unverified.
These are operational steps, not a guarantee that every infection will be detected. Their value is making the response less chaotic when time matters.
4. Make the decision proportionate to the threat
A small newsroom with no known targeting shouldn't automatically impose the most restrictive device configuration on everyone. Restrictions can interfere with accessibility, reporting tools, and day-to-day work. But organizations with staff covering conflict, surveillance, corruption, or powerful political actors should plan for a higher level of risk.
A practical decision rule is to ask three questions: Who could benefit from access to this person's device? What information would be exposed if it were compromised? What would the newsroom do in the first 24 hours after a credible alert? If the answers point to a high-impact target and there's no response plan, the priority usually isn't another security product. It's accountability, reducing avoidable exposure, and getting expert support in place.
Conclusion
AdFection highlights a security problem that's easy to miss: the ad supply chain can be more than a privacy issue when it becomes a path for targeted exploitation. Citizen Lab's findings describe 45 confirmed infections at Al Jazeera and a broader ecosystem where ads were brokered across many apps and websites. The report doesn't prove that every ad is dangerous, but it does show why user training alone isn't enough.
For newsrooms, the sensible response is proportional preparation: keep devices supported and updated, limit unnecessary data collection, define how high-risk staff should communicate, and decide who will investigate a suspected infection. If you manage a newsroom or work with sensitive sources, review your mobile-device and incident-response plans now - before any warning arrives. For the underlying reporting, start with Citizen Lab's findings as covered by Ars Technica.