A report published by Ars Technica describes targeted advertising being used as a vector to deliver zero-click exploits that install mercenary malware. According to the report, the ads served as the entry point for exploits that required no interaction from the target to execute.

Ad-Tech as a Delivery Vector

The account places advertising infrastructure at the center of the attack chain rather than on the periphery. In this framing, ad delivery is not merely a lure but the mechanism through which the exploit reaches its intended targets.

Zero-Click Exploitation

The exploits described in the report are characterized as zero-click, meaning they do not depend on a user action such as clicking a link or opening a file in order to run. The report states that the exploits were used to install mercenary malware.

What the Report Covers

Ars Technica's account is the primary source for these details. The report does not, in the facts available here, specify the identity of the operators, the targets, or the particular advertising systems involved. Readers seeking those specifics should consult the original reporting.