Zero‑click spyware spreads globally via malicious online ads, researchers report

Security researchers have uncovered a sophisticated zero‑click spyware campaign that is reaching devices around the world by embedding malicious code in online advertisements, according to a new analysis first reported by The Record.

Unlike traditional malware that requires a user to click a link or download a file, zero‑click exploits operate without any direct interaction, leveraging vulnerabilities in software to install surveillance tools automatically. This capability makes the threat especially dangerous because victims may remain unaware that their devices have been compromised.

The researchers say the spyware is delivered through targeted ad placements on legitimate publishing sites. By inserting malicious payloads into the ad content, the attackers can reach specific devices based on factors such as operating system version or geographic location. Once the ad is rendered in a browser or within an app, the embedded exploit triggers, silently installing the spyware without prompting the user.

Early indicators suggest that the campaign has affected a wide range of smartphones and computers across multiple continents. The spyware is designed to harvest a variety of data, including location, microphone and camera feeds, and messaging histories, providing a comprehensive surveillance capability to whoever controls the command‑and‑control infrastructure.

This development arrives amid growing concerns about the commercialisation of surveillance tools. In recent years, similar exploits have been linked to state‑backed actors and cyber‑crime groups, but the use of advertising networks as a delivery vector marks a shift toward more scalable, hard‑to‑trace distribution methods. Analysts warn that the blending of advertising and malware could erode trust in online content ecosystems.

Industry experts are calling for immediate action, urging ad platforms to strengthen vetting processes, improve transparency, and adopt stricter security standards for third‑party content. Meanwhile, security teams are advised to keep software patched, employ behavioural detection tools, and monitor network traffic for anomalous activity. The researchers plan to continue monitoring the threat and will share technical details with relevant stakeholders to aid remediation efforts.