Loading malware…
Aladdin is a zero-click malware delivery mechanism associated with commercial spyware vendor Intellexa and its Predator spyware ecosystem. It abuses commercial mobile advertising infrastructure to deliver weaponized advertisements to selected devices without requiring clicks or other user interaction. Targets are selected using their public IP addresses and other identifying information, with demand-side advertising platforms used to place malicious advertisements on participating websites.
The advertisements redirect selected devices to Intellexa exploit-delivery infrastructure, enabling attempted compromise when an advertisement loads. Aladdin functions as an initial-access and malware-delivery mechanism rather than a standalone surveillance payload. Although linked to Intellexa through leaked internal materials, a live infection attributable specifically to Aladdin has not been publicly demonstrated. Confirmed advertising-based spyware infections associated with Candiru are a separate operation and do not establish Aladdin deployment.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
First deployed in 2024 and believed to still be operational and actively developed, Aladdin leverages the commercial mobile advertising system to deliver malware. The mechanism forces weaponized ads onto specific targets identified by their public IP address and other identifiers, instructing the platforms via the Demand Side Platform (DSP) to serve it on any website participating in the ad network.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An advertising-based tool linked to spyware maker Intellexa through leaked documents. It is mentioned as a comparison to the Candiru campaign; the content states that no live infection through Aladdin had been demonstrated.
Aladdin is a zero-click exploit delivery mechanism used by Intellexa to distribute spyware such as Predator. It utilizes malicious ads on third-party platforms to fingerprint and redirect targeted users to exploit servers, enabling infection without user interaction. Aladdin is designed to minimize exposure of exploits and increase infection efficiency against selected targets.
Aladdin is a zero-click infection mechanism used by Predator spyware, delivering exploits via malicious advertisements. Targets are infected simply by viewing an ad, without any interaction required. It uses ad networks to deliver payloads to specific individuals based on identifiers like IP address.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.