Targeted ads delivered 0-click exploits to install mercenary malware
Citizen Lab says Discover-Tech ads delivered Candiru zero-click exploits that installed mercenary spyware.
Citizen Lab reported the AdFection campaign, in which Discover-Tech served targeted ads that delivered zero-click exploits and installed mercenary spyware from Candiru, also known as Integrity Labs. Ad code contacted Candiru servers, which returned an exploit and payload when the ad rendered. Google, IAB Europe, Beeswax, Vungle, and Eskimi have since removed, paused, or blocked Discover-Tech. Impressions appeared on networks linked to NATO, the United Nations, European lawmaking bodies, Australian critical infrastructure, and Norwegian and Swedish government and military agencies. The report does not name the vulnerabilities or the final malware.