Targeted Ads and Zero-Click Exploits: Real Threat?

Yes, targeted ads have been used as a delivery mechanism for zero-click exploits that install mercenary spyware, though this is a rare, highly sophisticated attack chain reserved for high-value targets, not a general threat to everyday users. The most publicly documented case involves the Israeli spyware company NSO Group, whose Pegasus software was delivered via a malicious link embedded in ads on social media platforms. This article explains how such attacks work, who is at risk, and what you can actually do to protect yourself.

Background: What Are Zero-Click Exploits and Mercenary Spyware?

Zero-click exploits are vulnerabilities that allow an attacker to compromise a device without any interaction from the user—no clicking a link, opening a file, or entering a password. They are extremely valuable because they bypass the most common security advice: “don’t click suspicious links.”

Mercenary spyware refers to commercial surveillance tools sold by private companies to governments and law enforcement. Unlike consumer spyware (like stalkerware), these are sophisticated, expensive, and typically sold under license. The most well-known is NSO Group’s Pegasus, but other companies like Cytrox (with its Predator spyware) also operate in this space. These tools can read messages, track location, turn on the microphone, and exfiltrate data from a phone.

The combination of zero-click exploits and targeted advertising is a potent attack vector because it exploits the very systems designed to show you relevant ads.

How a Targeted Ad Delivers a Zero-Click Exploit

The attack chain is complex and involves several stages. Here is how it works in a typical scenario:

1. Target selection: The attacker (often a government agency) identifies a specific individual—a journalist, activist, lawyer, or dissident.
2. Ad purchase: The attacker buys a targeted ad campaign on a platform like Facebook, Instagram, or X (formerly Twitter). The ad is designed to appear only to the target, using phone numbers, email addresses, or device identifiers.
3. Malicious payload: The ad itself contains a link to a website controlled by the attacker, or the ad’s rendering process exploits a vulnerability in the platform’s app or the phone’s operating system.
4. Zero-click trigger: In a true zero-click attack, the exploit fires when the ad is loaded or when the phone processes the ad’s metadata—no interaction needed. The exploit code then runs with elevated privileges.
5. Spyware installation: The exploit downloads and installs the spyware (e.g., Pegasus) onto the device. The spyware hides itself, often using rootkits to avoid detection.
6. Data exfiltration: The spyware begins collecting data and sending it back to the attacker’s command-and-control server.

This is not a theoretical scenario. In 2021, researchers at Citizen Lab and Google’s Project Zero documented a chain where Pegasus was delivered via a zero-click iMessage exploit, but the ad-based delivery method was also confirmed in several investigations. The key takeaway is that the ad is not the exploit itself; it is the delivery vehicle.

Who Is Actually at Risk?

This is the most important question for the average reader. The answer is: almost certainly not you, unless you are a high-profile target.

Mercenary spyware is expensive—licenses can cost millions of dollars per year. Governments do not spend that kind of money to monitor ordinary citizens. They use it on:

• Journalists covering sensitive topics
• Human rights activists and dissidents
• Political opponents and their families
• Lawyers representing controversial clients
• Business executives in sensitive industries (e.g., energy, defense)

If you are not in one of these categories, the risk of being targeted by a zero-click exploit delivered via an ad is extremely low. However, that does not mean you are immune to other forms of malware or phishing. The vast majority of cyberattacks target everyone indiscriminately, but they use much simpler methods.

How to Protect Yourself: Practical Steps

Even if you are not a high-value target, good security hygiene reduces your risk. For those who might be at risk, there are stronger measures.

For everyone:

• Keep your operating system and apps updated. Zero-click exploits often target known vulnerabilities that are patched quickly. Updating closes the door.
• Use strong, unique passwords and enable two-factor authentication (2FA). This does not stop spyware, but it prevents account takeovers.
• Be cautious about what you click, even in ads from known contacts. But remember, zero-click means you might not have to click anything.

For high-risk individuals:

• Use a device specifically for sensitive communications, separate from your personal phone.
• Consider using a lockdown mode if available. Apple’s Lockdown Mode on iPhones and iPads significantly reduces the attack surface by disabling features that are commonly exploited.
• Use end-to-end encrypted messaging apps, but be aware that spyware can read messages before they are encrypted if it is installed on the device.
• Regularly check for signs of compromise, such as unusual battery drain, unexpected reboots, or strange background processes. However, sophisticated spyware is designed to avoid detection.

Common Misconceptions: What Targeted Ads Cannot Do

There is a lot of confusion about what targeted ads can and cannot do. Let’s clear up some common myths:

Myth: Any ad can infect your phone. No. The ad must be part of a deliberate attack. Regular ads from legitimate companies are not malicious. The exploit is hidden in the ad’s code or the landing page, not in the ad’s content.

Myth: If you don’t click, you’re safe. False for zero-click exploits. The exploit can fire just by loading the ad in your feed. However, this is extremely rare and requires a high-value target.

Myth: Antivirus software will catch it. Not necessarily. Zero-click exploits are designed to evade detection. They often use “fileless” techniques or hide in memory. Antivirus is a useful layer, but not a guarantee.

Myth: Only iPhone users are at risk. No. Pegasus has been found on both iOS and Android. The exploit depends on the vulnerability, not the platform.

Comparison: Targeted Ads vs. Other Delivery Methods

Targeted ads are just one of several ways mercenary spyware is delivered. Others include:

• Phishing links: Sending a malicious link via SMS or email, often disguised as a legitimate service. This requires the user to click.
• Zero-click exploits via messaging apps: As seen with iMessage, the exploit fires when a specially crafted message is received, no click needed.
• Physical access: Installing spyware directly on the device when the attacker has physical possession, even for a few minutes.
• Supply chain attacks: Compromising a software update or a legitimate app to distribute spyware.

Targeted ads are attractive because they are harder to trace back to the attacker and can be precisely targeted. However, they are also more visible to the platform, which can detect and remove them. In practice, most attacks still use simpler methods like phishing.

Safety and Legal Considerations

It is illegal to use spyware to monitor someone without their consent in most jurisdictions, and the sale of mercenary spyware is increasingly regulated. However, the companies that sell these tools often operate in countries with lax laws, and the buyers are usually governments that may not be subject to the same legal constraints.

If you suspect you are being targeted, do not attempt to remove the spyware yourself—you might destroy evidence. Contact a digital security organization like Citizen Lab or a trusted cybersecurity professional. They can help you analyze your device and, if necessary, involve law enforcement.

For the average user, the best defense is to stay informed and maintain basic security hygiene. The threat is real, but it is not aimed at you.

Frequently Asked Questions

Can a targeted ad install spyware without me clicking anything?

Yes, but only in the case of a zero-click exploit. These are extremely rare and are used only against high-value targets. The exploit takes advantage of a vulnerability in the operating system or app that processes the ad, so no interaction is required. For everyone else, clicking a malicious link is still the primary risk.

How do I know if I’m a target of mercenary spyware?

You likely won’t know. Spyware is designed to be invisible. Signs might include unusual battery drain, random reboots, or increased data usage, but these are also common with normal apps. If you are a journalist, activist, or lawyer working on sensitive cases, you should assume you might be a target and take proactive measures like using a separate device and enabling lockdown mode.

Does Apple’s Lockdown Mode really stop Pegasus?

Lockdown Mode significantly reduces the attack surface by disabling features that are commonly exploited, such as certain web technologies and incoming FaceTime calls from unknown numbers. It is not a 100% guarantee, but it makes it much harder for spyware to be installed. Apple has stated that Lockdown Mode blocks known Pegasus-like exploits. It is a strong recommendation for high-risk individuals.

Can I remove Pegasus or Predator from my phone?

It is very difficult to remove sophisticated spyware manually. The best course is to back up your important data, then perform a factory reset and restore from a backup that predates the infection. However, if the spyware is in the firmware, a factory reset may not help. In that case, you need a new device. Always consult a professional if you suspect infection.

Are targeted ads the most common way spyware is delivered?

No. Phishing links via SMS or email are far more common because they are cheaper and easier to execute. Targeted ads are a sophisticated method used by advanced actors, but they are not the norm. The majority of spyware infections still rely on user interaction, such as clicking a malicious link.

Related

• Spooky Tech Stories: Real Creepy Tales
• Google Keep Signing Me Out? Fixes That Work
• Direct vs Regular Mutual Fund Plans: What to Compare