The spyware industry has found its most elegant distribution channel yet: the same ad-tech plumbing that serves you mattress promotions and retargeted sneakers. According to new research from the University of Toronto's Citizen Lab, multiple governments are now exploiting real-time bidding systems and ad networks to deliver zero-click surveillance payloads to targeted devices—turning the $600 billion digital advertising ecosystem into a precision weapon.
The technique, which Citizen Lab researchers have been tracking across at least three state-sponsored campaigns since late 2025, requires no user interaction. Targets don't click malicious links or open suspicious attachments. They simply load a webpage or app that serves ads. The attack rides in on an ad impression, exploiting browser or app vulnerabilities before the page finishes rendering. By the time the banner loads, the device is compromised.
The ad-tech attack surface
Programmatic advertising operates on millisecond auctions. When you visit a site, your device fingerprint, IP address, and behavioral data are broadcast to dozens of ad exchanges and demand-side platforms, which then bid to serve you content. This architecture—designed for commercial efficiency—creates a perfect targeting mechanism for surveillance. State actors can bid on impressions served specifically to devices associated with a journalist's home IP, a dissident's mobile carrier block, or a diplomat's known travel patterns.
Citizen Lab identified infections linked to campaigns targeting individuals in the Middle East, Southeast Asia, and Eastern Europe. The spyware variants observed share code similarities with commercial surveillance tools previously sold to government clients, though attribution to specific vendors remains incomplete. What's clear is that the ad-tech layer provides both targeting precision and plausible deniability—the malicious payload arrives through legitimate infrastructure, making forensic attribution significantly harder.
Why ad networks can't easily fix this
The advertising industry's response has been predictably inadequate. Major ad exchanges contacted by researchers issued statements about "robust security measures" while declining to specify what those measures are or whether they've detected similar abuse. The fundamental problem is structural: real-time bidding systems are designed to be permissive and fast, not secure. Verification happens after the auction, if at all. A malicious actor posing as a legitimate advertiser can win impressions and serve payloads before anyone reviews the creative.
Browser vendors and mobile platforms bear responsibility too. Zero-click exploits require vulnerabilities to exploit—the ad network is merely the delivery truck. But patching alone won't solve a problem where the attack surface is the entire commercial web. Every ad-supported page becomes a potential vector.
Our take
This is the logical endpoint of surveillance capitalism's architecture meeting state-sponsored surveillance's ambitions. The ad-tech industry built the most sophisticated targeting system in human history and left the keys under the mat. Now governments are walking through the door. The uncomfortable truth is that meaningful defense probably requires rethinking how programmatic advertising works—adding latency, verification, and friction that the industry has spent two decades eliminating in pursuit of efficiency. Don't hold your breath. Until then, the advice for high-risk individuals is grimly simple: use an ad blocker, and understand that it's now a security tool, not just a convenience.
