What is zero-click spyware?

In plain English

Most hacking needs you to do something: open an attachment, tap a link, enter a password. Zero-click spyware needs none of that. It exploits a flaw in software your device runs automatically, such as a messaging app that previews an incoming file, or an advert that loads code when a page or app opens. Once it is in, the spyware can read messages, listen through the microphone and track location, usually with no visible sign on screen.

Why it matters now

Citizen Lab this week published the first public technical confirmation of zero-click spyware delivered through targeted advertising. Researchers found that an Israeli company sold ad targeting that let spyware partners identify a specific device and infect it the moment an ad was rendered. Devices at Al Jazeera were infected this way. That turns the ordinary ad system behind hundreds of billions of daily auctions into a potential delivery route for surveillance.

An example

A journalist opens a free news app on their phone. An ad slot loads, an automated auction picks a bid aimed specifically at that device’s advertising ID, and the winning ad quietly carries code that installs spyware. The journalist sees nothing unusual and never taps the ad.

What to watch out for

This is not a threat most people face: mercenary spyware is expensive and aimed at journalists, activists, lawyers and officials. If you could plausibly be a target, keep your phone and apps updated, restart regularly, and look at the lockdown or high-security modes that iOS and Android now offer. For everyone else, the broader lesson is about the advertising system itself: the data it collects about your device, and the third-party code it runs inside apps and web pages, are a security problem as much as a privacy one.