An Israeli ad-tech company, Discover-Tech, was revealed by Citizen Lab as a delivery system for 'mercenary spyware' that hijacked major ad platforms like Google and Facebook. The company used programmatic advertising to serve zero-click malware to targeted individuals, including Al Jazeera workers, without requiring any user interaction. By leveraging certified access to over four billion ad-auctions, Discover-Tech collected user data and deployed malicious ads disguised as GDPR notices.
The report exposes how the entire ad-tech ecosystem is so insecure that merely loading a webpage could compromise devices. Discover-Tech, with ties to other Israeli spyware firms like Candiru (now Integrity Labs), was certified by Google, Yandex, Microsoft, Beeswax, and the IAB, enabling its widespread surveillance operations.
Source: Hacker News · Summarized by HeadlinesBriefing