‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads

The AdFection campaign reveals how threat actors are weaponizing the digital advertising ecosystem itself as an attack vector, requiring no user interaction to fully compromise a device. By embedding spyware delivery within legitimate-looking ad traffic, attackers exploited trusted third-party supply chains that most organizations never consider part of their threat model. The targeting of journalists at Al Jazeera underscores how mercenary spyware vendors like Candiru enable nation-state-level surveillance capabilities to be purchased and deployed against civil society. This matters because zero-click exploits bypass every traditional user-facing security control, making detection and prevention extraordinarily difficult without deep network and behavioral monitoring. The merger of ad-tech infrastructure with spyware delivery represents a fundamental escalation in the sophistication of commercial surveillance tools.