How do zero-click spyware attacks delivered through digital ads work?

Numbers match the citations in the article. A working link isn't proof that a page supports a claim; check the quoted passage and date.

1. 1

   Taxonomy of Spyware and Empirical Study of Network Drive-By-Downloads

   Calhoun: The Naval Postgraduate School Institutional Archive (Naval Postgraduate School) (Barwinski)Published Aug 31, 2005Checked Oct 15, 2026

   “Spyware has rapidly become a major security concern in government and corporate networks as well as for home computers. Spyware is able to circumvent common security practices, funneling information to remote parties and consuming system resources with impunity. This malicious software has infiltrated common search engines and Internet sectors generally considered "safe." Making use of browser vulnerabilities, spyware infection is wide-spread. This thesis considers common infection vectors and reviews current definitions in arriving at an improved definition of spyware. It identifies four common activities present in all spyware which lead to multiple behavioral capabilities. An empirical analysis of network drive-by-downloads shows the presence of spyware in bank, online travel, and real estate-related Internet sectors. The impact of system security patch maintenance on spyware susceptibility, and browser differences in the context of drive-by-downloads is also presented.”

2. 2

   Malvertising as a Vector for Cognitive Hacking: Integrating Technical and Psychological Defense Using the DISARM Framework

   RAIS Journal for Social Sciences (Burton)Published Apr 20, 2026Checked Oct 15, 2026

   “Malvertising, which embeds malicious code and psychological manipulation in digital ads, has become a major cybersecurity problem as it converges with cognitive hacking and disinformation. In 2024, incidents rose 10% year-over-year, with 29% involving misleading product offers, up from 26% the prior year, reflecting more deceptive tactics. Mobile environments face growing risks, as adware accounted for 35% of mobile threat detections in 2024. This qualitative study uses thematic analysis of recent industry data and academic reports to evaluate adaptive attack tactics and defense frameworks, including DISARM (Disinformation Analysis and Risk Management). Findings expose major gaps in governance, threat intelligence sharing, and the integration of technical and psychological defenses. The research concludes that a multidisciplinary strategy is vital to strengthen digital advertising ecosystem resilience and improve user protection. This work will interest cybersecurity professionals, researchers, policymakers, and digital advertising leaders seeking effective responses to emerging online threats.”

3. 3

   Emotions Behind Drive-by Download Propagation on Twitter

   ACM Transactions on the Web (Javed et al.)Published Aug 25, 2020Checked Oct 15, 2026

   “From the malicious (N= 105, 642) and benign (N= 169, 178) data sample identified, we built models to predict information flow size and survival. We define size as the number of retweets of an original tweet, and survival as the duration of the original tweet’s presence in the study window. We selected the zero-truncated negative binomial (ZTNB) regression method for our analysis based on the distribution exhibited by our dependent size measure and the comparison of results with other predictive models. We used the Cox regression technique to model the survival of information flows as it estimates proportional hazard rates for independent measures. Our results show that both social and content factors are statistically significant for the size and survival of information flows for both malicious and benign tweets. In the benign data sample, positive emotions and positive sentiment reflected in the tweet significantly predict size and survival. In contrast, for the malicious data sample, negative emotions, especially fear, are associated with both size and survival of information flows.”

4. 4

   Disrupting drive-by download networks on Twitter

   Social Network Analysis and Mining (Javed et al.)Published Aug 20, 2022Checked Oct 15, 2026

   “Policymakers and researchers have struggled to develop an efficient network disruption strategy to stop malware propagation effectively. We define an efficient strategy as one that considers network topology and dependency on network resilience, where resilience is the ability of the network to continue to disseminate information even when users are removed from it. One of the challenges faced while curbing malware propagation on online social platforms is understanding the cybercriminal network spreading the malware. Combining computational modelling and social network analysis, we identify the most effective strategy for disrupting networks of malicious URLs. Our results emphasise the importance of specific network disruption parameters such as network and emotion features, which have proved to be more effective in disrupting malicious networks compared to random strategies. In conclusion, disruption strategies force cybercriminal networks to become more vulnerable by strategically removing malicious users, which causes successful network disruption to become a long-term effort.”

5. 5

   The Erosion of Cybersecurity Zero-Trust Principles Through Generative AI: A Survey on the Challenges and Future Directions

   Journal of Cybersecurity and Privacy (Xu et al.)Published Oct 15, 2025Checked Oct 15, 2026

   “To expose this compounding risk, we contribute the Cyber Fraud Kill Chain (CFKC), a seven-stage attacker model (target identification, preparation, engagement, deception, execution, monetization, and cover-up) that maps specific generative techniques to NIST SP 800-207 components they erode. The CFKC highlights how synthetic identities, context manipulation and adversarial telemetry drive up false-negative rates, extend dwell time, and sidestep audit trails, thereby undermining the Zero-Trust principles of verify explicitly and assume breach. Existing guidance offers no systematic countermeasures for AI-scaled attacks, and that compliance regimes struggle to audit content that AI can mutate on demand. Finally, we outline research directions for adaptive, evidence-driven ZTA, and we argue that incremental extensions of current ZTA that are insufficient; only a generative-AI-aware redesign will sustain defensive parity in the coming threat cycle.”