“Zero click” means you’ve already given something permission to run on your device.

In this case, the ad network had permission to run scripts on the device, and they abused that privilege to run scripts that could install spyware.

People like us who have always blocked active scripts and ads aren’t vulnerable to most of these “zero click” attacks because we already distrust the mechanisms they abuse.

It’s why I prefer my email and texts to be pute text too, with no automation set to take action based on incoming unvetted content.

Once an ad loaded, code inside it could contact a Discover-Tech server. That server decided whether the visitor was a chosen target. If the details matched, it could return JavaScript that loaded more code and began the infection process. No click was needed.

This method works because modern ads are not always simple pictures or videos. They can include code for measuring views, tracking users, and loading content from other companies.

Real-time bidding systems also share data within a fraction of a second so advertisers can decide whether to buy an ad slot. That data may include a device ID, IP address, location, and browser details. AdFection used this design to find selected devices and send code only to them, making the activity harder for ad platforms and security researchers to catch.

https://cybersecuritynews.com/0-click-spyware-infects-devices/