Oct 26, 2026 · 33 min
Targeted ads can deliver zero-click spyware
The breach wasn't in the model.
The episode shows how an everyday advertising channel can become an intrusion path, while lawmakers struggle to impose accountability.
- 1Citizen Lab and Confiant research traced zero-click spyware delivery through targeted online advertising.
- 2Tim Starks explains why ad vetting, information sharing, and industry accountability remain difficult to enforce.
- 3A fake championship-ring offer shows how realistic incentives can expose phishing weaknesses inside organizations.
Don't miss
Tim Starks explains how targeted advertising can serve as a delivery mechanism for zero-click spyware, shifting the risk from content to infrastructure.
The brief
The episode’s central warning is that targeted advertising can do more than profile users: it can deliver zero-click spyware through the ad ecosystem.
CyberScoop senior reporter Tim Starks discusses Citizen Lab and Confiant research on adfection, where malicious advertising becomes an intrusion channel.
The reporting raises a governance problem: lawmakers including Cory Booker and Ron Wyden pressed for accountability, but legislative momentum remains limited.
The episode closes with the New York Knicks’ fake championship-ring offer, a phishing simulation that turned a tempting message into assigned security training.
Weekly email
State of the Pod, every Monday
The week's most-discussed names and stories from podcasts, with the moments behind them. Free, five minutes, unsubscribe in one click.