AdFection: Targeted ads turned into a pipeline for zero-click mercenary spyware

Original Article ↗ Hacker News Discussion ↗

Online advertising infrastructure is being turned into a delivery channel for “zero‑click” spyware, with a reported Israeli ad-tech firm using targeted ad auctions and JavaScript in banner ads to profile users and selectively deliver exploits to high‑value targets such as journalists and officials. Commenters highlight how the real-time bidding ecosystem leaks rich device and identity data, offers little content vetting, and makes it nearly impossible for publishers or users to know when an ad is malicious. The thread broadens into questions of ad network liability, the necessity of ad blockers for security, and the geopolitical implications of Israel’s prominent offensive cyber industry.

How the ad-based spyware pipeline worked

  • Discover-Tech ran a seemingly normal ad-buying platform, “certified” by major ad industry bodies, bidding in RTB auctions like any other buyer.
  • Ads were ordinary-looking banners (games, shopping, IP-lookup) that embedded a small script calling back to a “NOAS” server when rendered.
  • That script collected device identifiers, IPs, and sometimes publisher cookies/session tokens; cookie-syncing across partners built rich identity graphs.
  • A gatekeeper server then decided, based on IP and ad IDs, whether a viewer was a target. Most users got nothing; selected targets got a one-time handoff toward Candiru spyware.
  • Targets included journalists (e.g., Al Jazeera), plus networks of international organizations, governments, and defense entities; volume was huge (billions of bids, ~200k sites/apps).

Technical details and open questions

  • Citizen Lab links the campaign to Windows and Chrome CVEs from the early 2020s and to a Windows DLL using COM hijacking and a signed driver for kernel access.
  • Several commenters note the report is vague on the exact browser/OS exploitation chain from ad JavaScript to OS-level compromise, especially for mobile.
  • Others point to external analyses of Candiru’s “DevilsTongue” to fill in post-exploitation behavior, but the zero-click browser exploit itself remains unclear in the thread.

Effectiveness of ad blockers and mitigations

  • Strong consensus that network-level and browser ad blockers (uBlock Origin, Safari blockers, DNS-based blocking like Pi-hole/NextDNS) would have significantly reduced exposure, at least on the web.
  • Mobile in-app ads are harder to block; DNS filtering helps but can be bypassed.
  • Some mention hardened systems (e.g., GrapheneOS, privacy browsers), but there is no clear answer on whether they were or are immune.

Debate on responsibility and regulation

  • Many argue this proves online ads are a serious security risk and call for:
    • Making targeted advertising or third-party tracking illegal.
    • Holding ad networks and/or publishers legally and even criminally liable for malicious ads.
    • Requiring static, non-executable ad formats.
  • An adtech engineer counters that the ecosystem is fragmented and huge; vetting all creatives and landing pages is practically impossible at scale, and sophisticated actors can evade pre-scanning.
  • Critics respond that “too hard at scale” is not an acceptable excuse; if it can’t be done safely, the model itself should be constrained or dismantled.

Trust in Israeli tech and geopolitics

  • Extensive discussion links this case to a broader pattern of Israeli offensive cyber firms (NSO, Candiru, etc.) and alumni of military unit 8200 moving into commercial cyber offense and defense.
  • Some argue any Israeli security or adtech firm should be assumed closely aligned with state intelligence and thus untrustworthy; others note that many global enterprises rely heavily on Israeli security vendors.
  • Strong, polarized geopolitical debate ensues (ethnic cleansing, apartheid claims vs. “security needs”), including accusations of antisemitism on one side and of impunity and double standards on the other.

Broader lessons and user posture

  • Several commenters stress that the same kind of 0-day chains could be delivered via any content (emails, messaging apps, social media), but ad networks make it scalable, remote, and truly zero-click.
  • There is pessimism about the growing market for zero-days and mercenary spyware.
  • Repeated practical advice: treat ad blocking (plus MFA, limiting on-device financial access, and hardened OS/browsers) as basic hygiene, especially for high-risk users.