Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel
BLUF
Ad-tech platforms can become covert spyware delivery channels when abused for large-scale targeting and exploitation.
NEWS
Reports indicate that Discover-Tech’s ad operations were used by threat actors to fingerprint and track devices broadly. The same channel reportedly enabled delivery of Candiru zero-click spyware to selected targets, bypassing normal user actions such as clicking a link or downloading a file.
Why I Care
This matters because advertising networks sit close to millions of users and can provide detailed device intelligence, making them attractive for covert surveillance and targeted compromise. High-risk individuals such as journalists, activists, executives, government officials, and corporate employees are especially exposed if their browsing patterns or device fingerprints are used to select victims.
Next Steps
Security teams should immediately block known ad-tech indicators of compromise in browsers, proxies, DNS, and endpoint tools; prioritize patching browsers and operating systems; enable advanced browser isolation for high-risk users; and hunt for anomalous ad-related network activity. Ad platforms and web publishers should audit third-party ad partners, restrict fingerprinting capabilities, enforce stricter vetting of ad creatives, and share abuse indicators with industry peers within 24 to 72 hours.
Source: Security Week ·