Citizen Lab reports how targeted advertising was used in a spyware operation

What changed

The report is jointly authored by Bill Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis and Ron Deibert. Their technical investigation and supporting material are the original work behind this update. The six authors are credited together; no individual priority within the team is inferred.

For the advertising industry, the relevance is the potential misuse of systems designed to select audiences and deliver content. The report should be read with its methodology, evidence and vendor responses. A news summary cannot reproduce the full technical chain or settle every disputed point, and this article does not add allegations beyond the researchers’ published account.

PMC’s assessment is that the useful response for a buying team is a focused vendor discussion. Ask how creative and destinations are checked, how suspicious activity is investigated and what information is available when an incident is reported. Those questions are more actionable than assuming that routine campaign performance reporting would reveal a targeted security incident.

Agencies can also clarify internal escalation. Identify the person responsible for passing a credible security concern to the platform or technology provider, and retain the campaign identifiers and source evidence needed for investigation. Avoid circulating unnecessary personal information about affected people while seeking that support.

The report is an industry-research story with implications for trust in programmatic infrastructure. It is not an instruction to change a particular bid, targeting setting or campaign budget. Readers assessing the findings should consult Citizen Lab’s original research and the responses it records, keeping documented observations separate from broader conclusions about the advertising ecosystem.