Researchers at Citizen Lab report that Israeli-developed “zero-click” spyware can infect phones without users taking any action, by exploiting malicious ads displayed to victims. The technique, described as “AdFection,” relies on targeted advertising rather than links or downloads requiring interaction.
Citizen Lab says it identified evidence of device compromise tied to media organization Al Jazeera, where multiple devices were allegedly hacked after receiving malicious ads. The investigation describes how the spyware delivers itself through the ad ecosystem and how the victims’ behavior does not appear to be necessary for infection.
Across outlets, coverage centers on the operational method—targeted ads enabling drive-by style infection—and on the implications for digital safety and accountability. While the reports differ in emphasis, they all attribute the findings to Citizen Lab and describe an advertising-based intrusion capability that circumvents typical user defenses such as avoiding suspicious clicks.
