Governments Abusing Online Ads for 'Zero-Click' Spyware, Citizen Lab Reports

Government actors are leveraging global online advertising networks to deploy "zero-click" spyware, a method that can hack devices without requiring any user interaction, according to a new report by the digital rights research unit Citizen Lab. The spyware is delivered through malicious online advertisements.

The report, published Thursday, indicates that this technique has likely been responsible for the compromise of multiple devices. Citizen Lab found evidence that dozens of devices belonging to the media organization Al Jazeera were hacked after being exposed to these malicious online ads.

Citizen Lab highlights that such attacks are concerning due to their stealthy nature and potential to reach a wide range of targets effortlessly. "Zero-click" vulnerabilities, like those employed in this instance, exploit flaws in software that allow an attacker to gain control of a device simply by serving it specially crafted content or a file.

This discovery underscores a broader trend of sophisticated targeting methods employed by state-sponsored entities and reveals how common online services can be subverted for malicious purposes, posing a significant threat to individuals and organizations globally.