TorontoAds infected at least 45 Al Jazeera devices with spyware, Citizen Lab found.
Seeing the banner is enough to infect a device, with no click needed.
Israeli firm Discover-Tech bid in ad auctions and used ad-profile data to pick targets, the researchers say, delivering Candiru spyware.
Al Jazeera, based in Qatar, had not commented, and Discover-Tech did not answer press requests.
Discover-Tech held Google’s certified-vendor status until recently, and researchers urge users to block ads.
How each outlet framed it
- netzpolitik.org leans critical
- reports Citizen Lab's 'AdFection' finding: 45 Windows devices infected via ads with no click needed, first documented case
- netzpolitik.org
- advises readers to block ads for their own protection, framing ad blocking as a security measure
Sources: netzpolitik.org, netzpolitik.org