Governments are hacking people with ‘zero-click’ spyware by showing them online ads

Governments are leveraging malicious online ads to deliver “zero‑click” spyware that infects devices without any user interaction, a tactic confirmed by a digital‑rights investigation that linked dozens of compromised Al Jazeera workstations to a single ad campaign. This method sidesteps traditional phishing defenses because the exploit triggers automatically when the ad loads, leaving victims unaware. Understanding how this covert vector operates is essential for anyone who relies on digital tools for professional or personal communication.

Zero‑Click Exploits: How an Ad Becomes a Weapon

Zero‑click spyware exploits vulnerabilities in software that process web content, such as browsers or ad‑rendering engines, allowing code execution the moment an ad is displayed. Because the payload requires no click, tap, or download, typical user‑behavior safeguards—like avoiding suspicious links—are ineffective. The exploit chain usually begins with a malicious script embedded in the ad markup, which then leverages an unpatched flaw to gain system‑level access.

Once the code runs, it can install persistent components, exfiltrate data, or open back‑doors for later commands. Attackers often encrypt the payload to evade network‑level detection, and they may use legitimate ad‑network infrastructure to blend in with normal traffic. This camouflage makes it difficult for network defenders to distinguish malicious ad deliveries from benign impressions.

State Actors and the Economics of Surveillance‑as‑a‑Service

Nation‑state intelligence agencies have long sought scalable methods to surveil foreign journalists, dissidents, and policymakers. By purchasing or co‑opting ad‑network services, they can reach a wide audience with a single campaign, dramatically reducing per‑target costs compared with bespoke malware drops. The financial model mirrors a subscription service: governments pay a fee for the infrastructure that delivers exploits to any device that loads the targeted ad.

This approach also provides plausible deniability; the malicious ad appears to be a regular commercial impression, and the hosting platform can claim ignorance of the payload. Consequently, attribution becomes a forensic challenge, and diplomatic repercussions are delayed or muted. The scalability of ad‑based delivery means that a single exploit can compromise dozens, hundreds, or even thousands of devices in a short window.

Al Jazeera Case: Evidence of a Targeted Campaign

The digital‑rights unit’s analysis uncovered that dozens of Al Jazeera devices were infected after viewing the same malicious advertisement. The investigation traced the ad’s source to a network that routinely serves high‑traffic news sites, suggesting the attackers deliberately selected a platform with a global audience. Forensic logs showed the exploit executed immediately upon ad rendering, confirming the zero‑click nature of the attack.

Further technical review revealed that the spyware leveraged a previously unknown vulnerability in a widely used mobile operating system, indicating a high‑level investment in zero‑day research. The compromised devices included both desktop workstations and mobile phones, demonstrating the cross‑platform reach of the payload. The pattern of infection aligns with a strategic aim to monitor editorial communications and source contacts.

What This Actually Means For You

1. Even if you never click suspicious links, merely loading a web page that hosts a malicious ad can compromise your device.
2. Standard anti‑phishing tools may not flag zero‑click exploits because they do not rely on user interaction.
3. Keeping software—especially browsers and ad‑rendering libraries—up to date is the most reliable defense against unknown vulnerabilities.
4. Network monitoring that only inspects outbound traffic may miss the initial exploit, which often occurs within encrypted TLS sessions.
5. Organizations handling sensitive information should consider isolating critical workstations from public ad‑served content.

Immediate Action Steps

First, audit the software stack on all devices that access the internet, prioritizing browsers, rendering engines, and any embedded web‑view components. Apply the latest security patches from vendors, and enable automatic updates where possible to reduce the window of exposure.

Second, deploy a layered monitoring solution that can inspect encrypted traffic via TLS termination proxies or endpoint detection and response (EDR) tools capable of flagging anomalous process creation after web content loads. Regularly review logs for unexpected network connections originating from ad‑related processes.

Frequently Asked Questions

How can an online ad install spyware without any user click?

The ad contains malicious code that exploits a zero‑day vulnerability in the device’s ad‑rendering engine; the code runs automatically when the ad loads, requiring no interaction from the viewer.

Are standard antivirus programs able to detect zero‑click attacks?

Most traditional antivirus solutions focus on known signatures and suspicious file downloads, so they often miss exploits that execute entirely in memory without writing files to disk.

What steps can journalists take to protect themselves from such attacks?

Journalists should keep all software patched, use hardened browsers with script‑blocking extensions, and consider network segmentation that isolates editorial workstations from public web content.

What Do You Think?

Given the ease with which governments can weaponize ordinary ad infrastructure, should the tech industry prioritize mandatory security audits of ad networks over relying on voluntary compliance?