Most phone attacks you hear about need you to do something dumb: tap a strange link, install a shady app, type a password into a fake page. Zero-click attacks are different, and scarier, because the victim does nothing at all. Research groups that study digital surveillance, including Citizen Lab, have spent years documenting this class of threat and the ways it reaches people.
Here’s how it works in general terms, why advertising infrastructure keeps coming up in the conversation, and what a normal person can realistically do about it.
What zero-click means
A phone is constantly processing data it received from outside: messages, images, calendar invites, web pages, ads. Each of those requires software to parse the content. If that parsing code has a bug, a carefully crafted file can trigger it and make the phone run the attacker’s instructions. No tap required.
Zero-click is simply the label for an attack where the malicious content gets processed automatically. The trick isn’t magic. It relies on a vulnerability, usually one the vendor doesn’t know about yet, called a zero-day.
Why these attacks are rare but serious
Finding a working zero-click flaw in a modern phone takes serious engineering skill and money. The exploits are traded and sold, and surveillance vendors that sell to governments price them accordingly. That’s why the typical targets are journalists, activists, lawyers, politicians, and diplomats, not random shoppers.
If you’re an average user, your chance of being hit is very low. But the same flaws, once discovered and patched, protect everyone, which is why keeping software updated matters so much.
Where ads come into it
Online advertising is a giant system for delivering content to specific devices. An ad is basically a small piece of web content fetched and displayed by an app or browser. It travels through several intermediaries, and the advertiser can often choose who sees it using signals like location, device type, and interests.
That combination is useful to an attacker. If an ad can be targeted narrowly, and if rendering the ad content touches vulnerable code, then the ad system becomes a delivery pipe. The attacker doesn’t need your phone number or email, only some identifier that the ad ecosystem already tracks.
It also means the privacy side matters. The same data collection that powers tailored ads can help someone find and single out a person. Reducing that exposure is protective on its own.
Practical protections
Update promptly
Install operating system and app updates as soon as you can. Many patches fix exactly the kind of bug these attacks use.
Use lockdown-style modes if you’re high risk
Major phone makers offer an extreme protection setting that disables risky features like some message previews, complex web technologies, and incoming connection types. It reduces convenience but also shrinks the attack surface. People in sensitive jobs should consider it.
Limit ad tracking
Turn off the advertising identifier or reset it regularly, and deny apps permission to track you across other apps. Consider a content blocker or private DNS service that filters ad domains. Fewer ads loaded means fewer chances for hostile content.
Restart often
Some advanced implants don’t survive a reboot, so restarting your phone regularly forces an attacker to re-infect it. It isn’t a guarantee, but it’s free.
Trim your apps
Every app that displays ads or loads web content is another path in. Remove what you don’t use.
If you think you’ve been targeted
- Don’t just delete things. Evidence is valuable for investigators.
- Contact a digital security helpline run by civil society groups that support at-risk people.
- Use a different, clean device for sensitive communication until you’ve had help.
- Watch for unexplained battery drain or heat, though these are weak signals and have many harmless causes.
The policy angle
Researchers argue that the surveillance industry and the ad-tech industry both need tighter oversight. Calls include stronger export controls for spyware, more transparency from ad networks about who can buy targeted placements, and limits on location data sales. Whether regulators move quickly is uncertain, but public pressure and ongoing research matter.
Takeaway
Zero-click spyware is a niche but real threat, and ad networks are one of several routes that can carry it. You can’t eliminate the risk, yet updates, tracking limits, and smart settings cut it substantially. For most readers the lesson is simple: keep devices current, share less data with advertisers, and support the researchers who expose these tools.
Featured image: Bathroom lock.JPG by Sekuloff, CC BY-SA 3.0, via Wikimedia Commons.
