Targeted Ads Used to Deploy 0-Click Mercenary Malware
Original: Targeted ads delivered 0-click exploits to install mercenary malware
Why This Matters
Ad networks reaching billions of devices now represent a viable spyware delivery channel.
Threat actors exploited ad-targeting infrastructure to deliver zero-click exploits installing mercenary spyware on victims' devices, with no user interaction required, per Ars Technica reporting.
According to Ars Technica, attackers weaponized targeted advertising systems to silently push zero-click exploits to specific individuals, resulting in the installation of mercenary malware — the kind typically sold by commercial surveillance vendors to government clients. Zero-click attacks require no action from the target; simply receiving a malicious ad payload is enough to trigger device compromise. Using ad-targeting infrastructure adds a disturbing layer of precision: attackers can filter by device type, OS version, location, or even individual identifiers to hit exactly who they want, while remaining largely invisible to security researchers who don't match the targeting criteria. Mercenary spyware — tools like Pegasus or similar commercial products — is designed for persistent, covert surveillance including access to messages, microphone, and camera. This attack vector marks a significant escalation, turning the programmatic advertising stack, already widely criticized for privacy risks, into a delivery mechanism for state-grade surveillance tools.