DataBreachesDissent
Spyware makers used ad network to deliver zero click attacks
Part of the Caramel Tsunami story · since 15 Oct
- Thu 15 Oct, 14:36 UTC. Security Affairs, first report. Spyware Firm Used Adverts to Target Users With Zero Clicks.
- Thu 15 Oct, 16:27 UTC. The Hacker News, its first report on the story. Candiru spyware reached real devices through targeted online ads, Citizen Lab finds.
- Sat 17 Oct, 11:30 UTC. SecurityWeek, its first report on the story. Spyware Campaign Used Targeted Ads to Deliver Zero Click Hacks.
- Mon 19 Oct, 20:30 UTC. Dark Reading, its first report on the story. Spyware Firm Used Online Ads to Launch Zero Click Infections.
- Tue 20 Oct, 08:19 UTC. SecurityOnline, its first report on the story. Spyware Used Targeted Ads to Infect Al Jazeera Devices Without Clicks.
- Tue 27 Oct, 19:05 UTC. DataBreaches, its first report on the story. Spyware makers used ad network to deliver zero click attacks. This article, 6th of 6.
Security researchers at The Citizen Lab say governments are abusing global advertising networks to deliver zero-click spyware via online adverts. The group’s report identifies an Israeli firm, Discover-Tech, as enabling spyware makers to use its advertising platform to target individuals or devices worldwide with spyware capable of exfiltrating data without the victim needing to open a message or click a link.
Citizen Lab documents that at least two zero-click spyware developers, Candiru and Bindecy, used Discover-Tech’s platform to reach targets. The researchers describe Discover-Tech as presenting itself as a legitimate advertising firm while functioning as a bridge between ad vendors and the mercenary spyware ecosystem. The report, highlighted by TechCrunch, emphasises the potential for this pipeline to facilitate covert spyware infections at scale.
The piece notes Discover-Tech’s role in enabling targeted deployments rather than broad, non-specific campaigns. The details come from a University of Toronto lab investigation into surveillance and digital rights abuses, with attribution to The Citizen Lab and corroborating reporting from TechCrunch. The article summarises the researchers’ findings and stresses the importance of the ad-tech supply chain in enabling state-linked spyware operations.
How the story developed
6 articles from 6 outlets since 15 Oct. Picked up again today after 7 days quiet. This was the 6th report, 12 days after the first.
- Thu 15 Oct, 14:36 UTC. Security Affairs, first report. Spyware Firm Used Adverts to Target Users With Zero Clicks.
- Thu 15 Oct, 16:27 UTC. The Hacker News, its first report on the story. Candiru spyware reached real devices through targeted online ads, Citizen Lab finds.
- Sat 17 Oct, 11:30 UTC. SecurityWeek, its first report on the story. Spyware Campaign Used Targeted Ads to Deliver Zero Click Hacks.
- Mon 19 Oct, 20:30 UTC. Dark Reading, its first report on the story. Spyware Firm Used Online Ads to Launch Zero Click Infections.
- Tue 20 Oct, 08:19 UTC. SecurityOnline, its first report on the story. Spyware Used Targeted Ads to Infect Al Jazeera Devices Without Clicks.
- Tue 27 Oct, 19:05 UTC. DataBreaches, its first report on the story. Spyware makers used ad network to deliver zero click attacks. This article, 6th of 6.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 6 articles as a listHide the list
- Thu 15 OctDay 02
- Spyware Firm Used Adverts to Target Users With Zero Clicks14:36 · Security Affairs · First report
- Candiru spyware reached real devices through targeted online ads, Citizen Lab finds16:27 · The Hacker News
Quiet for 2 days
Sat 17 OctDay 21- Spyware Campaign Used Targeted Ads to Deliver Zero Click Hacks11:30 · SecurityWeek
Quiet for 2 days
Mon 19 OctDay 41- Spyware Firm Used Online Ads to Launch Zero Click Infections20:30 · Dark Reading · Picked up again
- Tue 20 OctDay 51
- Spyware Used Targeted Ads to Infect Al Jazeera Devices Without Clicks08:19 · SecurityOnline
Quiet for 7 days
Tue 27 OctDay 121- Spyware makers used ad network to deliver zero click attacks19:05 · DataBreaches · Picked up again · This article, 6th of 6