Keep reading:

https://citizenlab.ca/research/how-discover-tech-turned-targ...

Yes, in fact I skipped to that section. It describes targeting, and then a vague mention of ad impressions leading to "connections" to a C2 server (but the simple fact of contacting a domain doesn't establish C2; anyone can send an AJAX request anywhere). Then they describe a "fingerprint" of servers which appears to consist of... HTTP responses with several blank fields and a claim of running on Apache. Then they say that they found a compromised DLL, which they attribute to the ads based on the DLL hard-coding some domains related to the ad campaign.

But there is nothing explaining how the DLL becomes zero-click compromised by the ad.

	▲	boston_clone 2 hours ago \| parent [-]
		> they attribute to the ads based on the DLL hard-coding some domains related to the ad campaign No, their attribution is much more robust than this. Neglecting those details to oversimplify your explanation is intellectually dishonest. > there is nothing explaining how the DLL becomes zero-click compromised [...] They do, just a little later in that same section: "Both samples use a COM hijack for persistence [...]" through a malicious DLL. https://attack.mitre.org/techniques/T1546/015/