A familiar piece of security advice is starting to look incomplete: don't click suspicious links. A new round of reporting says spyware has been infecting journalists' devices through ads they never clicked. The same news roundup also flagged an exploited zero-day in Palo Alto firewalls, a critical Drupal flaw and criminal charges against an OpenAI engineer accused of bugging an executive room. The first item matters most for anyone who works with sensitive sources, because zero-click spyware delivered through malicious ads journalists encounter while browsing changes what personal defense looks like.

How zero-click ad spyware reaches journalists

The key word is "zero-click." Traditional phishing needs a person to open a file or tap a link. A zero-click attack needs no action from the target. Here, the delivery channel is online advertising: an ad is shown to a targeted person, and that ad is enough to start a compromise.

According to coverage of research from The Citizen Lab, the digital rights research unit at the University of Toronto, this is the first time technical evidence has been publicly released showing sophisticated mercenary spyware distributed through targeted ads. Some reports also describe an Israeli advertising agency placing ads that left the people who saw them open to spyware attacks. We have only summary-level detail on the technical mechanics, so treat specifics with caution until the full research is read.

The broader pattern is clear, though. Advertising networks are built to pick out particular audiences and deliver content to them without their involvement. That same precision is attractive to surveillance vendors who want to reach a specific person, such as a reporter, without the person doing anything wrong. An earlier case involved dozens of devices at a media organization: our report on Citizen Lab's findings about Al Jazeera devices hacked via malicious ads covers how the same category of attack was documented there.

Why a VPN alone does not stop this attack

This is a privacy site, so the VPN question is worth answering directly. A VPN encrypts traffic between your device and the VPN server and hides your IP address from sites you visit. Those are real benefits, but they address a different problem.

A malicious ad is delivered over the normal web, and the content still reaches your browser or app whether or not your connection is tunneled. If the underlying device has an unpatched weakness that the ad content can exploit, the VPN does not change that. Some VPN products include ad or tracker blocking at the DNS level, which can reduce exposure, but that is a separate feature and not a guarantee. A VPN is one layer, and it should not be mistaken for protection against spyware delivered through the content you load.

Protections that reduce exposure: updates, ad blockers and lockdown modes

No single step makes a person immune to a well-funded attacker, but several measures narrow the opening.

  • Install updates promptly. Spyware of this kind depends on software flaws. Operating system and browser updates close those flaws, so delaying them keeps the door open longer.
  • Use an ad blocker. If the infection route is an ad, then not loading the ad removes the delivery path. Browser-based blockers and network-level filtering are both options.
  • Turn on hardened modes. Major mobile platforms offer high-security settings meant for people at elevated risk of targeted attacks. They trade some convenience for a smaller attack surface, which is a reasonable bargain for journalists, activists and similar users.
  • Reduce what runs in the background. Remove apps you do not use, limit ad-heavy apps, and keep browsers and apps updated alongside the operating system.
  • Restart and monitor. Regular reboots and attention to unusual battery drain, heat or crashes are not proof of anything, but they are cheap habits. Newsrooms with IT or security staff should ask them to review devices of staff covering sensitive beats.

Organizations also have a role. A media outlet can set a baseline policy requiring updates, mandatory hardened modes for high-risk reporters and approved ad blocking on work devices, instead of leaving each reporter to work it out alone.

Palo Alto zero-day: a reminder to patch edge devices

The same roundup noted that a zero-day in Palo Alto firewalls is being exploited. We do not have details from the summary beyond that, so check the vendor's own advisories for affected versions and fixes. The lesson overlaps with the spyware story: attackers go after the software people assume is protecting them. Firewalls and other edge devices sit between a network and the internet, which makes them valuable targets, and an exploited zero-day means attacks are happening before or as a fix becomes available.

If you manage such equipment, treat vendor guidance as urgent, restrict management interfaces from public exposure where possible, and review logs for unusual activity. The roundup also mentioned a critical Drupal flaw, which site owners running that platform should check against official security notices.

What This Means For You

If you are a journalist, researcher, activist or anyone who may interest a government or a surveillance contractor, "I don't click strange links" is no longer enough. The risk can arrive through ordinary browsing. For most other readers, the practical risk is lower, but the steps that help high-risk users also benefit everyone: updates, ad blocking and a sensible approach to which apps you keep.

The OpenAI bugging charge is a separate story, but it fits a theme: surveillance threats range from remote software to physical devices, and sensitive conversations deserve care in both worlds.

Key takeaways

  • Zero-click spyware malicious ads journalists may see can compromise a device without any click, so link caution alone is not a defense.
  • A VPN protects your connection, not your device from exploit content, so do not rely on it for this threat.
  • Apply operating system and browser updates as soon as they are available.
  • Enable lockdown or hardened modes on your phone and use ad blocking.
  • Patch edge devices such as Palo Alto firewalls quickly and follow vendor advisories.

For a documented example of malicious-ad compromise, read our coverage of the Citizen Lab Al Jazeera investigation, then spend ten minutes today updating your devices and switching on the strongest protections they offer.