The delivery mechanism was ordinary online advertising. Malicious code embedded in ads executed the moment the ad loaded on screen, meaning simply visiting a page serving the ad was enough to trigger the infection. In some cases, the ad loaded outside the visible viewport, running silently in the background without the user ever seeing it.

Key points from the research:

• Attribution points to Candiru, a commercial spyware developer whose products are marketed to government customers.
• Targets were devices associated with the news network Al Jazeera.
• The infection vector was online ads, not phishing links or malicious attachments.
• Exploitation was zero-click: the payload fired automatically when the ad rendered, with no user action required.
• Some ad impressions loaded off-screen, allowing the attack to proceed covertly.

The findings highlight how legitimate advertising infrastructure can be abused as a stealthy malware delivery channel, and how zero-click exploits remove the last line of defense that user awareness normally provides. Organizations with high-risk profiles—journalists, activists, and media outlets in particular—should treat ad-borne threats as a serious part of their threat model.

Source: The Hacker News

Does your organization have controls in place to detect or block malicious ads, or does this change how you think about ad-blocking as a security measure?