Citizen Lab, the digital rights research unit at the University of Toronto, says it has found evidence that dozens of devices at the media organization Al Jazeera were hacked after being shown malicious online ads. The finding, reported by TechCrunch on October 15, 2026, points to a worrying development: zero-click spyware malicious ads can now serve as a delivery route to a target's phone or computer, without the person tapping anything.

The public summary is brief, so this post sticks to what has been reported and explains the general mechanics and defenses that security researchers commonly describe.

What Citizen Lab found at Al Jazeera

According to the report, Citizen Lab found evidence that dozens of devices at Al Jazeera were compromised after the people using them were shown malicious online ads. The headline claim is that governments are abusing online advertising to deliver zero-click spyware, meaning spyware that infects a device without the victim opening a file or clicking a link.

The source summary does not name the spyware vendor, the specific ad networks involved, or the exact vulnerabilities used, and we will not guess at them. What it does establish is the target: a major media organization, where staff routinely handle sensitive sources and information. The word "allegedly" matters here too. These are findings from a research group, and details may emerge as more is published.

How a malicious ad can hack a phone without a click

A traditional attack needs you to do something: open an attachment, tap a link, install an app. A zero-click attack removes that step. It relies on a flaw in software that automatically processes content, such as a browser or app rendering an image, video, or web page. If the content is crafted to exploit that flaw, malicious code can run during normal operation.

Online ads fit this model uncomfortably well. Ads are loaded automatically when a page or app opens, often from third-party servers the publisher does not directly control. An attacker able to place a malicious ad in front of a chosen person could, in principle, trigger a vulnerability in the software that displays it. Ad targeting tools, which exist to pick out specific audiences, could help narrow delivery to the intended victim.

The key point is that the person did nothing wrong. Being shown the ad was enough, according to Citizen Lab's reported findings.

Why journalists and ordinary users are both exposed

Journalists are an obvious target. Newsrooms hold confidential contacts, unpublished material, and location data that governments may want. An attack that works through ads removes the need for a convincing phishing message, which staff are often trained to spot.

But the delivery channel is not limited to newsrooms. Ads reach nearly everyone who browses the web or uses free apps. Highly targeted spyware is typically expensive and aimed at specific individuals, so most people are unlikely to be the intended victim. Still, the same ad infrastructure serves everyone, and weaknesses in how devices handle web content affect all users until they are patched. Activists, lawyers, researchers, and others who might attract government interest should consider themselves part of the at-risk group, not just reporters.

What actually reduces risk (and what a VPN can't do)

It is worth being direct: a VPN alone does not protect against this kind of attack. A VPN encrypts your traffic between your device and the VPN server and hides your IP address from the sites you visit. It does not stop a device from rendering a malicious ad, and it does not fix a software vulnerability. If an exploit is delivered inside content your device loads, the tunnel simply carries it.

Measures that address the actual attack path include:

  • Update your operating system and browser promptly. Zero-click attacks depend on unpatched or unknown flaws. Installing security updates quickly closes known holes.
  • Use content or ad blocking. If the ad never loads, it cannot deliver the exploit. Blockers at the browser or network level cut exposure to third-party ad servers.
  • Enable Lockdown Mode where available. Apple's Lockdown Mode is designed for people at elevated risk and reduces the attack surface by limiting certain web and messaging features.
  • Restart devices regularly and reduce installed apps. Fewer apps means fewer ad-serving components and fewer places for flaws to hide.

What This Means For You

For most readers, the realistic risk of being personally targeted with government-grade spyware is low, but the lesson applies broadly: privacy tools work on specific problems, and no single tool covers everything. A VPN helps with network privacy. It is not a defense against exploits. If you work with sensitive sources or have reason to think you could be a target, treat device hardening and ad blocking as essential, and consider the stricter modes your phone offers.

Citizen Lab's work also feeds a wider policy debate. If you want more on the group's research and the argument over surveillance and encryption, read our coverage of how Citizen Lab flags encryption risks in Canada's Bill C-22.

Key takeaways

The Al Jazeera findings show that zero-click spyware malicious ads are a real delivery method, not just a theoretical one. You cannot control which ads are served, but you can control how exposed your device is. Install OS and browser updates as soon as they arrive, use an ad or content blocker, and turn on Lockdown Mode if you are at higher risk. Keep using a VPN if it suits your needs, but do not rely on it to stop an attack that arrives through the content your device loads. For the broader context on Citizen Lab's work and the surveillance debate, see our piece on Bill C-22 and encryption risks.