Spyware vendor Intellexa's "Aladdin system infects the target’s phone by forcing a malicious advertisement created by the attacker to be shown on the target’s phone ... Possible target identifiers or selectors could include a known advertising ID, an email address, a geographical location or an IP address", i.e. identifiers supported by the ad network or Demand Side Platform (DSP) used in the Aladdin system"
On deploying spyware via digital advertising, wild:
https://securitylab.amnesty.org/latest/2025/12/intellexa-leaks-predator-spyware-operations-exposed/
To Catch a Predator: Leak exposes the internal operations of Intellexa’s mercenary spyware - Amnesty International Security Lab
Drawing on leaked internal company documents, sales and marketing material, as well as training videos, the “Intellexa Leaks” investigation gives a never-before-seen glimpse of the internal operations of a mercenary spyware company focused on exploiting vulnerabilities in mobile devices, which enable targeted surveillance attacks on human rights defenders, journalists and members of civil society.

