People Are Being Microtargeted: When Online Ads Become a Spyware Delivery System
A person does not have to open a suspicious link, download a file, or answer a message to become a target of sophisticated spyware. A routine advertisement displayed inside a website or app may be enough to identify a device and, in selected cases, begin an attack. Researchers call this technique AdFection: the use of targeted advertising as a route for zero-click spyware. 1
Ā
The findings are alarming because they connect two systems most people experience separately: programmatic advertising, which decides which ad appears on a screen, and mercenary spyware, which can secretly monitor a device. The University of Torontoās Citizen Lab says it has found the first public technical evidence of mercenary spyware delivered through targeted ads. Its investigation links the method to attacks on Al Jazeera devices. 1
Ā
How an advertisement can become an attack
When a website or app loads an ad, it can trigger a split-second automated auction. The request may contain information such as a device identifier, IP address, approximate location, operating system, and the page or app being used. Advertisers and intermediaries use those signals to decide whether to bid for the impression. 1Ā 2
Ā
Citizen Lab says Israeli company Discover-Tech used its Controlium platform to connect this advertising infrastructure with spyware providers. Discover-Tech presented itself as an advertising business; the report identifies Candiruāalso referred to in reporting as Integrity Labsāas the spyware vendor linked to the Al Jazeera attacks. The distinction matters: the researchers describe Discover-Tech as the advertising and targeting intermediary, not as the maker of the spyware. 1Ā 3
Ā
The process can unfold in stages. A seemingly ordinary ad is shown, and a script associated with it can send device information to Discover-Tech. Most people who receive one of these ads are not selected for infection; Citizen Lab says the ad may collect profiling information without returning code to execute. If a device is selected, however, the system can direct it to malicious code and exploit a software flaw. 1
Ā
āZero-clickā means the victim does not need to tap a link or approve a download. It does notĀ mean that every ad infects every device, or that merely displaying an ad automatically gives an attacker complete control. As cybersecurity analyst Eddy Willems explained to Al Jazeera, code running inside a browser may still need another vulnerability to escape the browserās isolated environment and reach the wider device. 2
Ā
Ā
Journalists among the targets
Al Jazeera said its technology team noticed unusual activity on journalistsā devices in 2024, with suspicious patterns continuing into 2025. Citizen Lab analysed network logs supplied by the network and said at least 45 devices were targeted. The sequence it observed moved from contact with Discover-Tech infrastructure to a Candiru validation server and, for infected devices, onward to a command-and-control server. The researchers linked the attacks to Candiru spyware with high confidence. 1Ā 3
Ā
The targeted staff included journalists who had reported on sensitive subjects. Al Jazeera condemned the targeting and said it would continue protecting its staff and systems. The case is especially serious because surveillance of reporters can expose confidential sources, unpublished material, communications with colleagues, and the safety of people who share information with the press. 3
Ā
The implications extend beyond one newsroom. In four months of bidding records, Citizen Lab identified Discover-Tech ads appearing across nearly 200,000 websites and Android or iOS apps. The researchers also found evidence that the operation directed millions of devices in dozens of countries to its profiling and infection infrastructure. Ads appeared on networks associated with government bodies, international organisations, media outlets, and critical infrastructure. 1
Ā
Those observations need careful interpretation. An ad impression on a government or international-organisation network is evidence of exposure to the advertising operation and possible profiling; it is not, on its own, proof that the userās device was infected. Citizen Lab says more investigation is needed to determine whether users on those networks were compromised. Confiant separately reported ad activity on sensitive networks, including the U.S. Department of Defense, the International Atomic Energy Agency, and the International Criminal Court, without establishing infections there. 1Ā 4
Ā
A systemic weakness, not just a clever exploit
The ad industry is built to move quickly and at enormous scale. A single page load can trigger an auction involving multiple companies, while data about a user and device travels through a chain of intermediaries. Researchers say the same machinery that makes precise ad placement possible can also help an operator find a specific person, learn about their device, and deliver a tailored exploit without the familiar warning signs of phishing. 1Ā 2
Ā
Citizen Lab reported that Discover-Tech had been able to operate through major advertising networks. After the investigation, Google ended Discover-Techās access to its ad exchange platforms, while Beeswax removed the company from its buying platform, Vungle paused access during a review, and Eskimi blocked its accounts and domains. These measures show that intermediaries can intervene, but they also raise a basic question: why did a company linked to spyware distribution remain able to buy and place ads for so long? 1
Ā
Researchers and analysts called the findings āincredibly concerning.ā UCLA professor Remesh Srinivasan told Al Jazeera that people are being āmicrotargetedā: surveillance can move from broad population profiling to finding an individual through ordinary digital systems and selecting that person for a highly intrusive attack. 2
Ā
For individuals, practical safeguards still help, even though none is a guarantee against a sophisticated exploit. Keep phones, browsers, and apps updated; consider a reputable content blocker; review or disable the mobile advertising identifier where the operating system allows it; and use enhanced security modes if you face elevated risk. Journalists, activists, officials, and others with sensitive roles should also follow security guidance from their organisation, since targeted threats may require specialist support. 2
Closing Thoughts
My view is that this story should change how we think about the word āadvertisement.ā A digital ad is not always just an image or a pitch for a product. It can be part of a complex delivery chain that profiles a device and, in the most dangerous cases, helps put exploit code in front of a chosen target. People should not have to become cybersecurity specialists just to browse safely.
Ā
The deeper failure is institutional. A system that distributes code to billions of screens must treat security as a core responsibility, not as an afterthought. Ad platforms need to know who is buying access, scrutinise the full chain of partners, and respond quickly when researchers identify abuse. Regulators also need to set clear limits on the collection and circulation of personal data in advertising auctions.
Ā
What is the true implication of this?
The central implication is that targeting and surveillance can be combined. Advertising data can help narrow down who a person is and what device they use; spyware can then turn that knowledge into access to private communications and other sensitive information. The result is not merely another way to deliver malware. It is a pathway from routine data collection to covert, highly selective intrusion.
Ā
The case also demonstrates how a commercial system can be repurposed for state-linked or mercenary surveillance. The researchers have not established which governments, if any, used every capability described in the report. But the documented connection between ad infrastructure and spyware is enough to demand stronger oversight and independent investigation.
Ā
How does this impact us?
Most people are unlikely to be singled out for an expensive spyware operation, but the underlying exposure affects everyone. The advertising ecosystem can reveal information about devices and browsing habits at scale, while weak vetting can let malicious buyers enter ordinary channels. For people who are targeted, the lack of a click, warning, or visible mistake can make an intrusion difficult to recognise and a compromise potentially devastating.
Ā
The public interest is therefore broader than personal device hygiene. Protecting journalists protects their sources and the publicās access to reporting. Protecting officials and critical infrastructure protects institutions. And reducing unnecessary data sharing in ad auctions lowers the amount of information available to anyone who wants to profile people in the first place.
Ā
References
Comments