Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware

[u/si9int]

https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

[u/andreichiffa]

Quoting Swift on Security, “deploy adblock or deploy malware”.

[u/pfak → u/andreichiffa]

Reading the article, a lot of these ads were embedded in applications. Not so easy to block for the average person. 

[u/acdha → u/pfak]

At the DNS level it’s more manageable, and that’s available on many home routers. Swift on Security is speaking from an enterprise context where that’s table stakes. 

[u/pfak → u/acdha]

"average person" 

[u/acdha → u/pfak]

Just saying, it’s literally a checkbox on some devices. Not universally available, no, but it’s not like setting up your own Linux server is a requirement and the on-boarding process for some of the third-party DNS services is not much more work. 

[u/WouldyousayitIRL → u/acdha]

The average person does not ever log into their router.

[u/404mesh]

What none of the reporting is covering is how the threat actors identified their targets in the first place. This isn't a 'malware incident' it's an industry failure that starts with the digital advertising ecosystem. The targeting step happens via bid requests identifying devices and individuals before any exploit fires. Fingerprint defenses don't patch the exploit, but they starve the identification layer, which is your Tor-uniformity hypothesis in a nutshell.

https://404privacy.com/blog/how-israel-used-ad-auctions-to-deliver-spyware-to-journalists/

[u/404mesh → u/[deleted]]

Yep, it’s why Google can afford to provide search and massive indexing for free to the entire world.

[u/404mesh → u/404mesh]

And why meta can afford to host billions and billions of photos on Facebook and Instagram.

[u/404mesh → u/[deleted]]

Me when I wrote this :(

Sometimes it’s better to engage with content than to just assume something came from an LLM.

The content of the article is valid and explains how these systems interact with each other to profile and identify high-risk individuals.

[u/VisualDirection7286]

Decision for defenders: treat the ad supply chain as hostile and sinkhole ad-exchange endpoints on high-risk devices. I chased an exploit-kit redirect through three ad brokers and never found the buyer. Ad creatives impersonating an enterprise's brand in that pipeline get flagged by doppel for its security team.

Demand side logs vanish fast, pull them early.

[u/iruleatants]

I keep seeing this shared but so far zero talks about or shows how they deploy zero-click malware. How are they going from an AD to actually deploying the malware with zero interaction?