Targeted ads delivered 0-click exploits to install mercenary malware

Zero-click attacks infect a phone without the owner tapping anything. Citizen Lab found that mercenary hackers bought targeted ads carrying code that reached control servers, which then delivered spyware to selected devices, including 45 phones at the Al Jazeera media network in 2024 and 2025. Google and ad platforms have since removed the vendor involved.

Summary written with AI by HowTechMoves, based on reporting by Ars Technica.