Citizen Lab: Governments are abusing online ads to deploy zero-click spyware

A new report from the University of Toronto’s Citizen Lab has uncovered a sophisticated surveillance technique where government actors exploit the online advertising ecosystem to deliver zero-click spyware. Researchers identified that dozens of devices belonging to staff at the media organization Al Jazeera were compromised after being exposed to malicious advertisements. Unlike traditional phishing attacks that require user interaction, this method leverages the automated nature of ad-tech platforms to inject malware silently. By manipulating ad-delivery networks, attackers can target specific individuals without their knowledge or consent. Citizen Lab warns that this abuse of digital advertising infrastructure represents a significant escalation in the capabilities of state-sponsored surveillance. The findings highlight critical vulnerabilities within the global ad-tech supply chain, which is being weaponized to bypass standard security protocols and compromise high-profile targets, including journalists and activists, through invisible, automated exploits.