A report by Citizen Lab revealed that Discover-Tech, an Israeli firm, used targeted online advertising to deliver 0-click exploits installing mercenary malware. The company leveraged ad networks including Google, Yandex, and Beeswax, and used GDPR consent frameworks to target users in the European Union. Major platforms have since taken action: Google and IAB Europe removed Discover-Tech from their vendor registries, Beeswax dropped the firm, Vungle paused access pending review, and Eskimi blocked its accounts.
The campaign, dubbed Ad Fection, distributed malware developed by Candiru (later rebranded as Integrity Labs). Targeted users received ads carrying JavaScript or other code connecting to Candiru’s control servers, which then delivered zero-click payloads. Ad impressions appeared on sensitive networks including NATO, United Nations, European lawmaking bodies, and government agencies in Norway, Sweden, and Australia.
Citizen Lab emphasized that the abuse highlights structural flaws in the online advertising ecosystem. While the specific vulnerabilities exploited remain undisclosed, they were likely zero-days since patched. The lab urged advertisers and officials to prevent similar campaigns and recommended users employ ad blockers, reset mobile advertising IDs, and keep systems updated.
Source: Ars Technica · Summarized by HeadlinesBriefing