The Signal 10/21/26 - Zero-click: the two scariest words in security, decoded

Researchers at Citizen Lab, a University of Toronto group that has spent years tracking spyware sold to governments, published a report with an ad security firm.

Here's the mechanism, and it's genuinely clever, which is why it's worth understanding rather than just fearing.

An advertising company that looked like any other ran ordinary looking ads across the internet, about 10 million a day by one estimate.

reaching tens of thousands of apps and over 100,000 websites.

Each ad carried a tiny script.

When the ad loaded, the script sent two things to the company's server, the device's advertising ID and its internet address.

The server checked them against a list.

For almost every device on earth, the answer was not interesting.

And nothing happened.

The ad was just an ad for a small number of devices.

The answer was, that's the one.

And the server sent back attack code that broke in without any action from the person holding the device.

That's the zero click.

The ad itself contained nothing harmful.

So the ad networks that scan for malicious ads found nothing.

The harm lived on the server and it was handed out only to targets.

Who are the targets? Researchers documented at least 45 devices at Al Jazeera, the news network, over 2024 and 2025.

The spyware was linked to Kandaroo, a company that sells surveillance tools to governments and that the United States blacklisted in 2021 after its products were used against journalists, officials, and activists.

The report doesn't name which government was behind these attacks.

The ads also showed up on the networks of international bodies, government offices in a couple dozen countries, chip makers, and other newsrooms.

The researchers are careful, and will be too.

An ad appearing on a network means an ad appeared.

It does not mean anyone there was infected.

Then the second half, the part that matters for the verdict.

Once the report landed, the ad industry moved.