Ad targeting was used as the delivery mechanism for zero-click exploits that installed mercenary spyware, according to reporting from Ars Technica.
The significance is in the combination rather than either half. Advertising networks exist to show specific content to a narrowly defined audience, and that is precisely the capability an attacker needs to reach one person rather than many. A zero-click exploit then removes the last thing the target could have done about it — there is no link to avoid and no attachment to refuse.
A targeted ad is not an obvious attack surface. It is the normal functioning of the web, rendered on pages the target already trusts, and it does not require the target to do anything at all.
Why it matters
- Ad targeting is a person-finding system with commercial legitimacy. It does not need to be compromised to be abused — it needs to be used as designed.
- Zero-click means the usual advice, don't click suspicious links, provides no protection whatsoever.
- Defence has to sit at the device and network layer, because the delivery path is legitimate infrastructure.