Zero-Click Attacks: How a Single Ad Can Become a Spyware Delivery Route

Zero-Click Attacks: 5 Critical Risks for Organizations: Zero-Click Attacks can compromise a device without the victim clicking a link, opening a file, or knowingly interacting with malicious content. That makes them especially difficult to detect: the familiar warning signs of phishing may never appear, while an ordinary-looking message, image, or advertisement may be enough to trigger an exploit.

A recent investigation by the University of Toronto’s Citizen Lab, conducted with cybersecurity firm Confiant, documented a striking example. Researchers described a technique they called “AdFection,” in which targeted online advertisements were used to deliver mercenary spyware. They reported that at least 45 devices at Al Jazeera were targeted and infected with Candiru spyware in 2024 and 2025. The researchers linked the operation to the spyware, but did not identify which government was behind it. The Citizen Lab

The case matters because advertising is part of the ordinary infrastructure of the internet. Ads can appear across websites and apps people use every day. In the reported campaign, the ad acted as a route to targeting infrastructure; researchers said the attack code was delivered only when a device was selected as a target. This shows how a familiar digital channel can be repurposed for highly targeted surveillance.

What Makes Zero-Click Attacks So Difficult to Stop?

Many cyberattacks rely on a person making a mistake, such as clicking a deceptive link. Zero-click exploits can bypass that step by taking advantage of a vulnerability in software that automatically processes incoming content or network traffic. If the vulnerable component handles the content before a user sees it, the attack may happen with little or no visible sign.

These attacks are often costly and technically sophisticated, and not every suspicious advertisement or unexpected message is evidence of a zero-click exploit. Still, organizations should treat the possibility seriously—especially when devices hold sensitive communications, credentials, or business information.

Google has documented other zero-click spyware cases, including an iMessage exploit that could compromise a device when a malicious message was received, without the user clicking a link. Google’s research also describes commercial surveillance vendors using and selling exploit capabilities to government-backed actors. blog.google

---

Five risks security teams should consider
Zero-Click Attacks: 5 Critical Risks for Organizations

1. Silent compromise: Users may not see a suspicious link or attachment that would prompt them to report an incident.
2. Sensitive data exposure: Spyware can put messages, files, credentials, and business communications at risk.
3. Targeted surveillance: Journalists, executives, public officials, and employees with access to sensitive projects may be singled out.
4. Wider attack surfaces: Mobile apps, browsers, messaging platforms, and advertising systems can all become part of the exposure.
5. Delayed detection: A device may appear to work normally while an attacker gathers information or maintains access.

Why Zero-Click Attacks Matter During Geopolitical Conflict

Cyber operations have become part of broader international tensions. In its 2026 Digital Defense Report, Microsoft described evolving state-sponsored operations involving Russia, Iran, China, and North Korea. The report notes a shared emphasis on persistent access to valuable environments. In a separate example, Reuters reported that Russia-linked hackers compromised more than 170 email accounts belonging to Ukrainian prosecutors and investigators. These cases are not evidence that every conflict-related cyber operation uses zero-click exploits; they illustrate why organizations connected to government, media, energy, and other critical sectors need strong detection and response capabilities. Microsoft

For organizations, the lesson is practical: threat actors can use different routes to gain access, and sophisticated spyware is only one part of the risk. A layered security program should account for vulnerabilities, compromised accounts, malicious software, and suspicious activity across devices and networks. Zero-Click Attacks: 5 Critical Risks for Organizations

Practical steps to reduce exposure

• Patch promptly: Keep operating systems, browsers, messaging apps, and security tools updated. Apply urgent security updates according to a documented process.
• Protect high-risk devices: Apply stricter controls to devices used by executives, journalists, administrators, and staff handling sensitive information.
• Limit exposure: Restrict unnecessary apps and permissions, and use mobile-device management to enforce security settings.
• Monitor for suspicious activity: Combine endpoint protection, network monitoring, and centralized logging to help detect unusual behavior.
• Prepare to respond: Maintain an incident-response plan that covers device isolation, evidence preservation, credential resets, and recovery.
• Train employees: Explain that not every attack involves a convincing email or a user click; encourage prompt reporting of unusual device behavior.

These controls cannot guarantee protection against every zero-day exploit. They can, however, reduce exposure, improve the chances of detection, and help teams respond faster when a device or account is suspected of compromise.

How AGT can help

AGT supports organizations with cybersecurity assessments, endpoint and network monitoring, digital forensics, incident response, and security training. These services can help identify weaknesses, investigate suspected compromise, and strengthen protection across IT and critical infrastructure environments. Read more about: “Zero-Click Attacks: 5 Critical Risks for Organizations”

---

Sources

• The Citizen Lab — Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware
• Confiant — ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming
• The Hacker News — Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera
• Google Threat Analysis Group — Google’s Efforts to Identify and Counter Spyware
• Microsoft — Digital Defense Report 2026
• Reuters — Russia-linked hackers compromised Ukrainian prosecutors’ email accounts
• Google Search Central — Creating Helpful, Reliable, People-First Content