Israeli Firm Reportedly Used Digital Ads to Deliver Zero-Click Spyware

Digital advertising has become a new vector for cyberattacks. According to security research, an Israeli company distributed zero-click spyware through online ad networks, with an attack chain that completes infection without any user interaction.

Original report: Israeli firm's digital ads enabling installation of 'zero-click' spyware (Source: rss, HN discussion)

Attack Mechanism: How Ads Become a Spyware Launchpad

The term "zero-click" means the entire attack requires no action from the target — no link clicks, no attachment downloads, no permission grants. Traditional malvertising usually relies on users clicking through or triggering a vulnerability, but the chain exposed in this case treats the ad delivery platform itself as the infection entry point.

Attackers embed malicious payloads into ad creative or the ad delivery pipeline. When the ad loads on a partner website or within an app, a vulnerability in the browser or rendering engine is triggered, and the spyware lands silently. The entire process is invisible to the user, who is simply browsing a page as usual.

According to the discussion on HN, the stealth of this type of attack lies in the fact that ad networks are legitimate commercial infrastructure. Security products often allow ad domains through, making detection significantly harder than with traditional phishing emails.

The Technical Basis of Zero-Click Attacks

Zero-click attacks do not rely on a single vulnerability; they typically combine multiple stages: parsing flaws in rendering engines (such as memory corruption when browsers process images, fonts, or media codecs), system-level privilege escalation vulnerabilities, and silent installation mechanisms used for persistence. Drawing on historically disclosed cases, commercial spyware such as Pegasus and Predator have used "no-interaction" exploit chains delivered through instant messaging channels like iMessage and WhatsApp, where a victim could be infected simply by receiving a message. The cost of such attack chains is extremely high — a complete zero-click exploit chain can command millions of dollars on the gray market, which explains why these tools primarily target high-value targets rather than ordinary users.

The Evolution of Malvertising

Early malvertising mainly relied on "clickbait" tactics — for example, disguised play buttons or fake system update prompts. It then evolved into "drive-by downloads," where exploiting a vulnerability is triggered automatically when a user visits a compromised page, though it still required the user to visit a specific page. The form exposed in this case goes a step further: the ad network itself is the delivery pipeline. By purchasing ad placements, attackers can get malicious payloads onto pages across a large number of legitimate websites without controlling the target sites, expanding the delivery surface from "a single hacked site" to "an entire ad alliance."

Why "Zero-Click" Is More Dangerous Than Traditional Spyware

Zero-click attacks bypass one of the most fundamental pieces of security training advice — don't click suspicious links. When users don't need to do anything, human vigilance is no longer a line of defense; protection depends entirely on patching vulnerabilities at the endpoint and browser levels.

This type of spyware typically has clear targets, aimed at specific groups such as journalists, activists, and corporate or government executives. Attackers pursue long-term persistence and data theft rather than ransomware monetization, so an infection may go undetected for months.

From a defensive standpoint, zero-click means the attack surface shifts from "user behavior" to "the software supply chain and the advertising ecosystem," posing entirely new detection requirements for enterprise security teams.

The Trust Gap in the Advertising Ecosystem

Digital advertising relies on complex real-time bidding and third-party script chains. A single page load can pull in code from dozens of domains. If any link in the chain is abused, it can become a poisoning point.

According to the report, the party involved is an Israeli company whose digital advertising capabilities were used to facilitate spyware installation. This once again raises questions about the supply chain of commercial surveillance tools: where is the boundary between ad-tech companies, surveillance software vendors, and government clients?

Discussion in the HN comments focused on two points: first, whether mainstream ad platforms have sufficient abuse detection capabilities; and second, whether existing legal frameworks can hold anyone accountable when surveillance tools use commercial advertising as cover.

The Risk Structure of Real-Time Bidding and Third-Party Script Chains

At the heart of programmatic advertising is real-time bidding (RTB): when a user opens a page, the publisher sends bid requests to multiple ad exchanges within tens of milliseconds, and the winning creative is rendered onto the page. A single bidding chain typically involves SSPs (supply-side platforms), DSPs (demand-side platforms), ad exchanges, verification companies, and data management platforms — each layer may introduce third-party scripts. The problem is that these scripts execute under the publisher's "first-party" identity, with the same privileges as the main site, making it very difficult for browsers and security products to judge trustworthiness based on domain alone. An attacker only needs to replace or inject malicious creative at any point in the chain to achieve "one-to-many" poisoning across a massive number of sites. This is why the ad-tech stack is viewed as a new attack surface akin to the software supply chain.

What Ordinary Users and Enterprises Can Do

Completely blocking zero-click attacks is unrealistic, but exposure can be significantly reduced.

• Keep browsers and operating systems up to date, and disable unnecessary automatic media loading
• Deploy visibility monitoring for ads and third-party scripts in enterprise environments
• Use isolated browsing environments for high-value targets to reduce the correlation between real identity and browsing behavior
• Security teams should include ad delivery pipelines in threat intelligence scope, rather than focusing only on email and endpoints

The core takeaway from this incident is that spyware distribution methods are migrating toward legitimate commercial infrastructure, and defenders need to keep pace with the changing attack surface.

Frequently Asked Questions

What is zero-click spyware? Zero-click spyware refers to surveillance software that can be installed without the user clicking, downloading, or granting permission, typically exploiting browser or system vulnerabilities to achieve silent infection.

How is digital advertising used to spread spyware? Attackers embed malicious code into ad creative or the delivery pipeline. When the ad loads on a legitimate website, it triggers a vulnerability and causes automatic infection — an upgraded form of malvertising.

How can ordinary users protect themselves? Keeping browsers and systems updated, restricting third-party scripts, and using isolated devices for sensitive individuals are currently the most practical mitigation measures.

One-line Summary

An Israeli firm is accused of using digital ad pipelines to distribute zero-click spyware that requires no user interaction.

Paragraph Summary

The article discloses that an Israeli company distributed zero-click spyware through online ad networks, with an attack chain that completes infection without any user clicks, downloads, or permission grants. The mechanism involves embedding malicious payloads into ad creative or the delivery pipeline; when the ad loads on a legitimate website or app, it triggers a browser or rendering engine vulnerability, and the spyware lands silently. Zero-click attacks bypass security training centered on "don't click suspicious links," so protection depends on vulnerability patching and endpoint monitoring. The article also notes that digital advertising relies on real-time bidding and third-party script chains, creating a new attack surface. HN discussion focused on ad platforms' abuse detection capabilities and accountability in the commercial surveillance tool supply chain, and proposed mitigations such as updating systems, restricting third-party scripts, and isolating browsing environments.