What did Citizen Lab find regarding the attack on journalists?

Citizen Lab concluded that Israeli companies carried out an attack delivered through targeted advertising that infected journalists' devices with spyware. The method was characterized as zero-click, meaning victims did not have to tap, download, or approve anything.

What does 'zero-click' mean in the context of spyware?

A zero-click attack works without the victim doing anything, relying on software automatically processing content rather than persuading someone to open a bad link. When a device loads an ad, it fetches and renders content on its own, and if malicious content is placed in that flow with an unpatched weakness, infection can occur.

Why are journalists particularly vulnerable to targeted advertising attacks?

Targeted advertising allows a buyer to narrow audiences by interests, location, device type, and other signals, which lets a surveillance vendor aim an attack at a particular person or small group. This precision also lowers the odds of detection, and journalists are an obvious fit for this kind of aiming.

Does the article provide technical details about which devices or ad networks were affected?

No, the coverage available does not spell out every technical detail such as which devices, which ad networks, or how many people were affected. The key takeaway is that the delivery channel was advertising, not a malicious email or suspicious text message.

Citizen Lab Finds Zero-Click Ads Infecting Journalists' Devices

A new Citizen Lab report, covered by The Globe and Mail, describes what may be one of the more unsettling uses of the advertising economy yet: zero-click ad spyware journalists never had to interact with. According to the report, Israeli companies staged an "attack delivered via targeted advertising" to infect journalists' devices with spyware. The same machinery built to show you shoes and streaming services, in other words, can reportedly be repurposed to reach a specific person's phone.

The summary we have is short, so this post sticks to what has been reported and explains the broader concepts around it. Where details are not available, we say so.

What Citizen Lab found in the ad-delivered attacks

Citizen Lab, the research group known for investigating digital threats against civil society, concluded that Israeli companies carried out an attack delivered through targeted advertising. The targets were journalists, and the result was spyware on their devices. The report characterizes the method as zero-click, meaning the victim did not have to tap, download, or approve anything.

The coverage available to us does not spell out every technical detail, such as which devices, which ad networks, or how many people were affected, so we will not guess at them. The key takeaway is the delivery channel: advertising, not a malicious email or a suspicious text message.

How zero-click ad spyware reaches journalists' devices

A zero-click attack works without the victim doing anything. Instead of persuading someone to open a bad link, the attacker relies on software processing content automatically. When a page or app loads an ad, the device fetches and renders that content on its own. If an attacker can place malicious content into that flow and the device has an unpatched weakness, the infection can happen as the content loads.

That is a general explanation of how ad-borne attacks can work, not a description of the specific exploit in the Citizen Lab report. What matters for readers is the principle: anything your device loads automatically is potentially an entry point, and that includes content you never chose to see.

Zero-click techniques are not new to the spyware world. Our coverage of a WeChat zero-click worm described how a single missed call could be enough to compromise a widely used messaging app. The ad-based route adds a different twist: the attacker does not need your phone number or an account, only a way to get content in front of you.

Why targeted advertising makes journalists easy to reach

Targeted advertising exists to let a buyer choose who sees a message. Audiences can be narrowed by interests, location, device type, and other signals. That precision is a feature for legitimate marketers. For a surveillance vendor, it is a way to aim an attack at a particular person or small group without broadcasting it widely, which also lowers the odds of detection.

Journalists are an obvious fit for this kind of aiming. Their work, interests, and locations are often public, and their devices may hold sources and unpublished material. The Citizen Lab finding suggests that the tracking infrastructure behind everyday ads can double as a delivery system for spyware.

What This Means For You

Most readers are not the intended target of a spyware operation like this. Targeted attacks of this kind are typically expensive and aimed at specific people. But the finding still matters to everyone, for two reasons.

First, it shows that ad content is not just a nuisance or a privacy issue. It is part of your device's attack surface. Second, the defenses that help against a sophisticated attack also protect you against ordinary threats: prompt updates, fewer automatic content loads, and tighter control over what your device accepts.

If you work in journalism, human rights, politics, or any field where you might attract a well-funded adversary, treat your risk as higher and act accordingly.

Practical steps to reduce your exposure

No single step makes you immune to zero-click attacks, but these measures shrink the opportunity:

Update your operating system and apps immediately. Zero-click attacks usually depend on unpatched flaws. Google's emergency fix for a Chrome zero-day exploited in the wild is a good example of why waiting a few days can matter.
Keep your browser current. Browsers process ad content constantly, so enable automatic updates and restart when prompted.
Block ads and trackers where you can. A reputable content blocker or browser-level protections reduce how much third-party ad content your device loads. This is a risk reducer, not a guarantee.
Enable Lockdown Mode if you are at higher risk. On supported Apple devices, Lockdown Mode restricts features that attackers commonly abuse. It trades some convenience for a smaller attack surface.
Limit ad personalization. Turn off ad tracking identifiers in your device settings and opt out of personalized ads. This makes you harder to single out, though it will not stop every targeting method.
Reboot periodically and remove apps you do not use. Fewer apps and regular restarts leave less room for persistent threats.

The bottom line

The report on zero-click ad spyware journalists faced is a reminder that the line between advertising technology and surveillance technology can be thin. You cannot control what ad networks do, but you can control how quickly your devices are patched and how much untrusted content they load.

Today's action list is short: install pending updates on your phone and browser right now, turn on automatic updates, and if you are at higher risk, enable Lockdown Mode. Those few minutes of effort close the gaps that attacks like this depend on.