Citizen Lab says governments are abusing online ads to hack people with ‘zero-click’ spyware

Citizen Lab has uncovered that governments are weaponising online advertising to install zero‑click spyware on target devices, with evidence pointing to dozens of compromised machines at Al Jazeera. The technique bypasses any user interaction, turning a routine web page visit into a covert intrusion. For anyone who relies on digital channels for work or news, the revelation reshapes the threat landscape and forces a reassessment of basic cyber hygiene.

Government Use of Malvertising as a Zero‑Click Vector

Citizen Lab’s investigation traced malicious code embedded in standard display ads that appeared on reputable news sites. These ads required no click; the exploit was triggered simply by loading the ad’s script, a method that sidesteps traditional phishing defenses. The report links the campaign to state‑backed actors, suggesting a strategic shift toward mass‑scale, low‑visibility espionage.

Unlike phishing emails, malvertising can reach a broad audience without prior knowledge of the target’s email address or browsing habits. By purchasing ad space through legitimate networks, attackers blend into normal ad traffic, making detection by network filters extremely difficult. The zero‑click nature also means victims remain unaware, allowing prolonged data exfiltration.

Technical Mechanics of Zero‑Click Exploits in Advertising Networks

The exploit chain begins with a compromised ad server that injects malicious JavaScript into the ad payload. When the ad loads, the script probes the device for known vulnerabilities in the operating system or installed browsers, then silently installs a surveillance payload. Because the code runs in the context of the ad, it inherits the same privileges as the host page, often bypassing sandbox restrictions.

Zero‑click spyware leverages “memory‑corruption” bugs that can be triggered without user input, such as malformed image files or malformed network packets. Once the payload lands, it establishes a covert command‑and‑control channel, typically over encrypted traffic that mimics legitimate services. This architecture makes signature‑based detection nearly impossible without deep behavioural analysis.

Implications for Media Organizations and Journalists

Al Jazeera’s experience, where dozens of devices were infected, illustrates the acute risk faced by newsrooms that routinely browse the web for sources and breaking stories. Journalists often operate under tight deadlines, making them less likely to scrutinise every ad or update security tools promptly. The breach compromises not only personal communications but also editorial archives and source confidentiality.

Beyond Al Jazeera, the findings suggest a broader campaign targeting media outlets worldwide, aiming to harvest unpublished reports, source identities, and strategic communications. The covert nature of zero‑click attacks erodes trust in digital platforms, forcing newsrooms to consider isolation strategies such as air‑gapped systems or dedicated secure browsers for sensitive work.

What This Actually Means For You

1. Zero‑click attacks bypass traditional phishing safeguards, so relying on email filters alone no longer protects you.
2. Ad‑based delivery means any website that serves third‑party ads could become a infection vector, expanding the attack surface beyond known malicious sites.
3. State‑backed actors can conduct sustained surveillance without leaving obvious traces, raising the stakes for journalists, activists, and any high‑risk individual.
4. Standard antivirus solutions may miss these exploits because they exploit unknown zero‑day vulnerabilities that lack known signatures.
5. Understanding the supply‑chain of online ads is now a critical component of personal and organisational cyber risk assessments.

Immediate Action Steps

First, audit the ad networks and plugins used on any devices that handle sensitive information; disable or block third‑party ad scripts where possible using browser extensions or network‑level filters. Second, ensure operating systems and browsers are patched to the latest versions, as many zero‑click exploits rely on unpatched kernel or rendering engine flaws.

Third, adopt a layered detection approach: enable behavioural monitoring tools that flag anomalous outbound connections, and consider employing endpoint detection and response (EDR) solutions that can spot unusual process injection. Finally, for high‑risk users, isolate critical work on dedicated machines that never load external ads or untrusted content.

Frequently Asked Questions

How do governments use online ads to deliver spyware?

Governments purchase ad space on legitimate networks, embed malicious code in the ad payload, and rely on zero‑click vulnerabilities to install spyware when the ad loads, all without any user interaction.

What is zero‑click spyware and why is it dangerous?

Zero‑click spyware exploits software bugs that execute automatically upon loading a malicious element, such as an ad, meaning victims do not need to click or open anything, making detection and prevention extremely challenging.

Which organizations have been targeted by this malvertising campaign?

The investigation identified Al Jazeera as a victim, with dozens of its devices compromised; the report suggests the technique is being deployed against other media outlets and potentially any high‑value target.

What Do You Think?

Given the ease with which state actors can weaponise ordinary web ads, should individuals and organisations rethink their reliance on ad‑supported platforms for any sensitive activity?