Citizen Lab has confirmed the first known mercenary spyware attacks delivered stealthily through digital ads without user interaction. Targets included journalists and government officials, with infections reported in Mexico.