Another zero-day is nice, sure. But today’s top story is even more charming, because it does not require you to “fall for phishing” or click anything. It just requires the modern internet ecosystem to do what it does best: monetize everything, including your dignity. Pour yourself a drink (scotch if you want to feel like you’re making good choices) and let’s talk about how an Israeli ad firm allegedly doubled as a delivery channel for Candiru’s zero-click spyware.
The Part Where “Legit Ads” Become a Weapon
The gist: ads served by Discover-Tech (as reported) can be used by threat actors to fingerprint and track devices at scale, and then infect selected targets. Zero-click spyware via malvertising is the kind of sentence that should come with a warning label on the browser. But no. Instead, we all pretend the ad tech stack is harmless because it says “targeting” and “engagement” and not “remote compromise.”
Here’s the real issue. Enterprises and CISOs treat advertising like a consumer problem, while attackers use the same plumbing to identify victims and push code without any user interaction. That means your endpoint controls, even when they are thoughtfully configured, might not help much if the compromise happens in the browser context and your users do not even realize something nasty just landed.
Why This Keeps Happening (Spoiler: IT Loves Complexity)
We keep getting surprised by supply chain and “trusted third party” attacks because most orgs operationalize security like a ritual. Run a scanner. Deploy a fancy tool. Write a policy no one reads. Then congratulate yourselves for “coverage” while the real world keeps moving.
Malvertising also exposes how thin the line is between “we block bad sites” and “we can stop the delivery mechanism.” If your security program is mostly perimeter cosplay and vendor dashboard worship, you’re going to keep getting surprised. And if your change management process takes longer than an attacker needs to pivot, congratulations. Your security lifecycle is just late theater.
What You Should Do Instead of Buying Another Product
Not everything is fixable at the snap of a finger, but you can reduce the blast radius. Focus on browser hardening, stricter content policies, real monitoring for suspicious script behavior, and endpoint protections tuned for exploit-like activity rather than only commodity malware. Also, stop treating “risk” like a quarterly performance metric. Risk is what gets you when the next zero-click chain shows up.
If you want to read the source (and maybe question your life choices), start here: Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel.
Final Thought, From Someone Who’s Seen This Movie
Vendors will sell you “visibility.” CISOs will promise “resilience.” IT will schedule a meeting. Meanwhile, attackers will keep abusing whatever ecosystem you rely on, because it works. Zero-click spyware delivered through ads is the perfect summary of modern security: high-tech compromises, low-tech preparedness.
