Cybersecurity News

Ads Became a Spyware Delivery Network

By Nattapong Sukkasem · Published 2026-10-18 · Updated 2026-10-21.

Most intrusion reports end with a version number. This one ends with an invoice for about $109,000 in ad spend. The cybersecurity news here is not a flaw in a product you run — it is that the advertising supply chain, which reaches almost every device your staff carry, has been shown working as a targeted code-delivery network against named journalists. The exploit was never recovered. The delivery system was.

What the Citizen Lab found

Two qualifiers belong at full strength. An ad impression is not an infection: the Citizen Lab is explicit that its telemetry shows where ads were shown — including on government, military, NATO, UN, EU and media networks — not that anyone there was targeted or compromised. And the browser exploit was never recovered, so whether a zero-day vulnerability was burned here is unknown.

How a clean ad becomes a zero-click infection

The design is built to survive inspection. A creative containing an exploit can be caught when the exchange scans it. A creative containing a <script> tag pointing elsewhere cannot, because the decision has moved off the ad and onto a server.

When Discover-Tech won a bid, the rendered ad called back to what the report calls a NOAS or "getAd" host, submitting the device's mobile advertising identifier or cookie ID together with its IP address. The host compared that against uploaded target segments. A match returned JavaScript, often loading a further iframe; everyone else received zero bytes. The exchange never saw malicious content, and neither did any scanner looking at the creative — for almost every impression there was nothing to see.

The sequence the Citizen Lab reconstructed from Al Jazeera's own network logs is fixed: ad host, then a Candiru validator that fingerprints the device, then the implant and its command-and-control. The targeting needs no exploit at all — it is the advertised capability of a demand-side platform, pointed at a list of people instead of a market segment.

Scale sharpens the point. Unlike a DDoS attack, where volume is the weapon, volume here was only the haystack: roughly 719 million bids carried the callback, while about 3.64 million devices were ever judged eligible and far fewer were attacked. The operation bought global reach in order to use almost none of it.

Ad tech is server infrastructure nobody audits

For an enterprise, this ran entirely on third-party server infrastructure no security team selected, reviewed or can inventory. An app installed from an official store embeds an SDK, which calls an exchange, which resolves a bid from a demand-side platform, which renders a creative, which fetches a script from a host nobody in the chain has audited. Every link is a legitimate commercial relationship. The code arriving at the end is arbitrary.

Part of the chain ran on mainstream hosting, which makes this a cloud security question in the plainest sense: the redirect and tracking infrastructure included a CloudFront distribution, so blocking by provider reputation would have achieved nothing. The Citizen Lab reached its conclusions partly through Discover-Tech's own failures — world-readable Apache Druid instances exposing roughly four billion bid records, and an unauthenticated login-log endpoint.

Platform responses arrived in early October, before publication: Google terminated the firm's exchange access for what it called systematic policy violations, IAB Europe suspended it after an audit, and Beeswax, Vungle and Eskimi each cut it off. Those removals are reactive by construction — the firm held approved-vendor status from 2020 until October 2026.

What name resolution actually sees

Here the architecture turns against the operator, in an inversion defenders rarely get. Normally the payload is loud and the beacon is quiet. Here the payload fired for a handful of people, but the callback host had to resolve on every impression — eligible or not, 0-byte response or exploit. The delivery domain was queried hundreds of millions of times to attack a few dozen journalists.

So a passive DNS record is the one artifact that exists regardless of whether a device was ever chosen. A resolver log covering 2024–2026 would hold mtrtb[.]com lookups from any handset that rendered one of these ads, long before validator domains appear on a machine actually selected. Retrospective hunting against the published indicators is cheap, and unlike endpoint forensics it still works on devices since wiped or retired.

Two caveats keep this honest. Those lookups only cross a resolver you control if the device uses one — a handset configured for DNS over HTTPS straight to a public provider resolves past your logging entirely, which argues for directing resolution on managed networks to servers you operate, not for treating encrypted DNS as the problem. On a mixed network of personal phones and corporate laptops the practical chokepoint is the gateway: pointing the router at a filtering resolver covers in-app ad traffic no endpoint agent will ever inspect, and our guide to changing DNS on a router is the shortest version of that work. The second caveat is that resolution proves contact, not compromise.

It is the mirror image of the GhostAction credential theft we covered this month, where exfiltration went to a bare IP address and generated no query at all. Attackers who need to reach millions of devices through commercial platforms do not get that option: scale requires names.

Six checks worth running this week

1. Hunt the indicators in passive DNS. Query historical resolver logs for the validator, C2 and ad-host domains across the full 2022–2026 window, not the last 90 days of retention.
2. Find out what your mobile fleet resolves. Most organisations log laptop traffic and nothing else. Ad SDKs run on the phones.
3. Treat high-risk roles differently. Journalists, executives, legal and policy staff warrant lockdown modes, managed browsers and ad blocking as a control.
4. Reset advertising identifiers on managed devices and disable ad personalisation. The identifier was the targeting key, so rotating it has real effect here.
5. Filter at the gateway, not only the endpoint, so in-app traffic that endpoint agents never see is still covered.
6. Keep the DNS evidence. Query logging retained for years is what makes this kind of retrospective hunt possible — and it is the cheapest telemetry in the IT security stack to store.

Industry impact

The significance of this cybersecurity news is not the spyware. Candiru has been documented since 2021, blacklisted, and sold on. The significance is that the delivery mechanism was a normal, approved participant in the world's largest automated code-distribution system, and stayed one for six years.

That reframes a familiar argument. Ad blocking has long been treated as a user preference with a bandwidth benefit. On this evidence it is attack-surface reduction, and the surface is one no patch cycle governs: an enterprise cannot update the exchanges, audit the demand-side platforms, or see most of the traffic, which originates inside third-party apps on phones.

What is left is unglamorous and durable. Reduce what renders arbitrary remote code, harden the people most likely to be targeted, and keep the one protocol log that records a relationship after the payload is gone. The teams able to answer "did anything of ours ever resolve those names?" are those already logging resolution before this report existed. For everyone else, the most useful response to this week's cybersecurity news is to start keeping that record now, so the next investigation has something to query.

Sources

• The Citizen Lab — Exposing AdFection: how Discover-Tech turned targeted ads into a pipeline for zero-click mercenary spyware
• The Hacker News — Citizen Lab traces zero-click Candiru spyware infections at Al Jazeera to targeted online ads
• BleepingComputer — Targeted ads installed Candiru spyware in zero-click attacks
• SecurityWeek — Israeli ad firm doubled as Candiru's zero-click spyware delivery channel
• CyberInsider — Online ads infected targets with Candiru spyware in zero-click attacks

Related articles

• Citrix NetScaler Zero-Days Exploited
• SonicWall SMA1000 Zero-Days Chained for Unauth RCE
• PaperCut NG and MF Zero-Day Exploited in the Wild

DNS angle

Review resolver logs for the systems discussed above and compare unexpected names with your approved services. A successful lookup does not establish that a destination is safe. Use the DNS lookup tool to inspect current answers, then compare them with your own resolver and incident records.

Source: The Citizen Lab — Exposing AdFection: how Discover-Tech turned targeted ads into a pipeline for zero-click mercenary spyware (2026-10-15).