Governments are hacking people with ‘zero-click’ spyware by showing them online ads
The detail that gets me here is the delivery mechanism. We've gotten used to spyware arriving through phishing links or malicious apps, but ads are the one thing everyone assumes is safe to ignore. Turning that assumption into an attack vector is a nasty piece of work, and it explains why the victims at Al Jazeera had no chance to dodge it. Zero-click means the target never has to slip up.
What I'd want to know next is who actually built this. The phrase "governments are hacking people" is doing a lot of work in that headline, because most of these operations run through commercial vendors selling spyware to states. That middle layer is where accountability keeps dissolving. The lab found the compromise, but tracing it back to a specific buyer is usually where the trail goes cold.
I also think this lands at a particular moment. We've seen a wave of reporting on mercenary spyware over the past few years, and each new disclosure makes the same point: the market for these tools is mature, and the defenses are lagging. Until platforms take malicious ad delivery seriously, journalists will keep being the test subjects.