Zero-click spyware is surveillance software delivered by exploiting a device or application without requiring the target to click a link, open a file, or take another deliberate action. An attack may use a flaw in a browser, messaging app, or other component to run code and install spyware.
Because there may be no suspicious interaction for a person to notice, these attacks can be difficult to prevent and investigate. In some reported campaigns, targeted advertising may help identify or reach devices, but seeing an ad does not by itself prove exploitation or infection. Defenses include promptly patching devices and apps, using endpoint monitoring and mobile-device management, and limiting exposure to untrusted content where practical. No single measure guarantees protection against a sophisticated exploit.