Targeted ads became a delivery path for spyware

Citizen Lab traced a spyware delivery chain through advertising infrastructure: an ad’s script contacted a selection server, which returned additional code for chosen targets. Its investigation identified at least 45 targeted Al Jazeera employees and connected the infrastructure to Candiru using network and malware evidence. Targeting is not proof of infection for every person, and ordinary ad exposure is not an infection count.

Citizen Lab · Oct 15, 2026

Why it matters

Ad delivery introduces executable third-party code into a trust boundary that publishers do not fully control.

More context

The technical account follows target selection, validation and command infrastructure. Read those sections for the evidence chain rather than interpreting billions of advertising bids as billions of compromises.

Keep in mind

The attribution is Citizen Lab’s assessment; the identified target set and confirmed device evidence have different scopes.

Original read