Citizen Lab Exposes Government Abuse of Online Ads to Deliver Zero-Click Spyware

Ad Slots as Attack Entry Points: A New Delivery Method for Zero-Click Spyware

Digital rights research organization Citizen Lab has released a new investigation revealing that multiple governments are abusing online advertising by embedding malicious code into ads to deliver "zero-click" spyware to target devices. Unlike traditional phishing attacks, these attacks rely on virtually no user action — victims don't need to click a link or download an attachment. Simply viewing a normal web page's ad slot may be enough to have surveillance software installed.

Citizen Lab says it found evidence that "dozens of devices" were compromised, with victims concentrated at the media organization Al Jazeera. These devices were compromised after displaying malicious online ads, with the attack chain hidden within everyday ad delivery systems.

Why Al Jazeera Became a Primary Target

Al Jazeera has long been a key target of commercial spyware. Several previously documented cases show that the organization's journalists and devices have been compromised by well-known spyware such as Pegasus. What's different this time is the delivery method: attackers no longer rely on vulnerabilities in SMS, iMessage, or WhatsApp, but instead hide malicious payloads within the digital advertising distribution chain.

For news organizations, advertising is a standard feature on virtually every website and app. This means the attack surface shifts from "active user interaction" to "passive exposure" — simply opening a page may allow a malicious ad to load automatically and trigger a vulnerability. For high-value targets such as journalists, dissidents, and human rights workers, this zero-interaction attack is extremely dangerous.

Why "Zero-Click" Is Trickier Than Phishing

Traditional cybersecurity training repeatedly emphasizes: don't click suspicious links. Zero-click attacks bypass this line of defense entirely. Attackers exploit vulnerabilities in device systems, browsers, or rendering engines, and malicious code may complete privilege escalation and persistence in the background even if the user does nothing.

Citizen Lab's investigation points the attack's origin to government-level actors, pushing the nature of the incident beyond ordinary cybercrime. Government-led spyware attacks typically involve longer development and testing cycles, more precise target selection, and more mature detection-evasion techniques. Switching the delivery channel to ad networks further increases the difficulty of tracing and interception: the advertising ecosystem has many participants, from advertisers and agencies to real-time bidding platforms and ad exchanges, and any link in the chain can be abused.

A zero-click attack refers to an attacker exploiting vulnerabilities in software on a target device (such as the operating system, browser, instant messaging app, image/media parser, etc.) to cause malicious code to execute automatically and complete the intrusion without the victim being aware of or taking any action. Its most fundamental difference from traditional "one-click/multi-click" attacks is that the trigger of the attack chain does not depend on any user decision, so social engineering defenses (such as security training and suspicious link warnings) are completely ineffective against it.

Zero-click attacks typically depend on two conditions: first, the existence of memory corruption vulnerabilities that can be triggered remotely (such as buffer overflows or use-after-free); second, the vulnerability resides in components that automatically process external input (such as message push, ad rendering, or image decoding). This also makes defense significantly harder than click-based attacks: the patching window is short, the exploitation barrier is high but once mature can be reused at scale, and persistence is often achieved before victims or security vendors discover it.

Commercial spyware refers to surveillance tools developed by private companies and sold to governments or law enforcement agencies. Typical examples include NSO Group's Pegasus, Cellebrite, and Hacking Team (now defunct). Their common capabilities include reading encrypted communications, remotely activating microphones and cameras, extracting location and contact data, and maintaining long-term persistence on devices.

Unlike ordinary malware, commercial spyware is usually sold under the guise of a "legitimate law enforcement tool," but its actual use has often been documented in cases targeting journalists, lawyers, human rights workers, and dissidents. This is why research organizations such as Citizen Lab treat it as a human rights and press freedom issue: supply chains, export licenses, usage audits, and accountability mechanisms are generally opaque, making abuse difficult to effectively constrain. Moving delivery channels into ad networks is precisely another evolution of such tools in anti-detection and anti-attribution.

The Security Blind Spots of the Advertising Ecosystem

This incident exposes structural flaws in the online advertising system. The real-time bidding mechanism for ads requires millisecond-level responses and often lacks strict content review; large numbers of third-party scripts are embedded in pages, blurring permission boundaries; and ad networks themselves span multiple jurisdictions, making uniform regulation difficult.

For ordinary users, feasible mitigation measures are limited: promptly updating operating systems and browsers, restricting unnecessary content rendering, and using tools with ad-blocking capabilities can reduce the probability of exposure, but cannot fundamentally eliminate this kind of abuse. A real fix requires coordinated action by ad platforms, browser vendors, operating system providers, and security research organizations to establish stricter ad content review and vulnerability response mechanisms.

By publicizing this finding, Citizen Lab's significance lies in bringing the evolution of attack methods out into the open: when spyware delivery shifts from "inducing clicks" to "silent exposure," the line of defense in cybersecurity must also expand from "user awareness" to "platform responsibility."

Real-Time Bidding (RTB) is the core transaction mechanism of online advertising: when a user opens a page containing ad slots, the ad exchange sends bid requests to numerous advertisers within tens to hundreds of milliseconds, and the highest bidder's creative is rendered onto the page immediately. The entire process is highly automated, with participants including advertisers, demand-side platforms (DSPs), supply-side platforms (SSPs), ad exchanges, and data management platforms (DMPs).

It is precisely this millisecond-level, multi-intermediary, cross-domain assembly structure that makes it difficult to complete content review before delivery. Attackers can forge advertiser identities, or hide malicious code in third-party creatives, landing pages, or even the images or scripts used in ad creatives. In addition, because many ad slots are dynamically injected by third-party scripts and permission boundaries are blurred, malicious payloads can be distributed through legitimate chains, further amplifying the exposure surface for zero-click attacks.

One-line Summary

Citizen Lab exposes multiple governments abusing online ads to deliver zero-click spyware to Al Jazeera devices.

Paragraph Summary

A new Citizen Lab investigation found that multiple governments are abusing online advertising by embedding malicious code into ads to deliver "zero-click" spyware to target devices. Unlike traditional phishing, these attacks require no clicks on links or downloads of attachments; users may have surveillance software installed merely by browsing a normal page containing ads. The investigation confirmed that dozens of Al Jazeera devices were compromised after displaying malicious ads, with the attack's origin pointing to government-level actors. The article analyzes why zero-click attacks are harder to defend against than phishing, why the real-time bidding and third-party script mechanisms of the advertising ecosystem constitute structural security blind spots, and points out that when delivery shifts from "inducing clicks" to "silent exposure," cybersecurity defenses must expand from user awareness to platform responsibility.