[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvjJZ027npVqHWD1qi4Aybl-rvFXzjJdNayqYMyxiciY":3},{"article":4,"iocs":53,"watch_terms":54,"solutions":55,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"a40723a3-345d-42ad-ad0e-68933e72dfd9","Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel","israeli-ad-firm-doubled-as-candiru-s-zero-click-spyware-delivery-channel-dc7947","Israeli company Discover-Tech’s ads allow threat actors to fingerprint and track devices at scale and infect selected targets. The post Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel appeared first on SecurityWeek.","An Israeli advertising company, Discover-Tech, has been identified as a key enabler for Candiru's spyware, facilitating zero-click attacks through targeted advertisements. The operation, dubbed AdFection, allowed threat actors to de-anonymize, fingerprint, and infect millions of devices, including those at Al Jazeera. Discover-Tech's Controlium platform leverages Real-Time Bidding auctions to deliver malicious ads, which can execute scripts to profile and compromise users.","Israeli ad firm Discover-Tech used for Candiru spyware zero-click attacks against Al Jazeera.","https:\u002F\u002Fwww.securityweek.com\u002Fisraeli-ad-firm-doubled-as-candirus-zero-click-spyware-delivery-channel\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F01\u002Fspyware-predator.jpg","2026-10-17T11:00:00+00:00","2026-10-17T12:00:06.509279+00:00",9,[17,20,22,25,28],{"name":18,"type":19},"Candiru","vendor",{"name":21,"type":19},"Discover-Tech",{"name":23,"type":24},"Controlium","product",{"name":26,"type":27},"Dark Cartographer","threat_actor",{"name":29,"type":24},"Al Jazeera","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,41,46,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,21,23],{"controls":56,"vendors":139},[57,86,110],{"slug":58,"name":59,"problem":60,"products":61},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":87,"name":88,"problem":89,"products":90},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[91,97,102],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":92,"product_name":93,"url":95,"description":96},"dnsfilter","DNSFilter","\u002Fvendor-logos\u002Fdnsfilter.png","https:\u002F\u002Fwww.dnsfilter.com\u002F","DNS filtering for offices and roaming devices.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":98,"product_name":99,"url":100,"description":101},"prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"slug":111,"name":112,"problem":113,"products":114},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[115,123,131],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",[],{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":156},"ad-network-used-as-zero-click-spyware-delivery-channel-via-real-time-bidding","Ad Network Used as Zero-Click Spyware Delivery Channel via Real-Time Bidding","Discover-Tech, an Israeli advertising firm, secretly operated as a delivery mechanism for Candiru's commercial spyware by weaponizing the Real-Time Bidding (RTB) ecosystem — a trusted advertising infrastructure used by millions of websites. Because RTB auctions execute code silently and at massive scale, threat actors were able to de-anonymize, fingerprint, and infect devices without any user interaction, making traditional awareness-based defenses irrelevant. This highlights the inherent danger of trusting third-party ad supply chains, where a single compromised or complicit intermediary can compromise millions of endpoints globally. Organizations and individuals have no direct visibility into the ad code executing in their browsers, creating a silent attack surface that is extraordinarily difficult to detect or remediate.",[145,146,147,148,149,150,151,152,153,154,155],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-161: Supply Chain Risk Management","NIST CSF DE.CM-7: Monitoring for Unauthorized Personnel, Connections, Devices, and Software","NIST SP 800-53 SC-18: Mobile Code","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","GDPR Article 25: Data Protection by Design and by Default","GDPR Article 32: Security of Processing","MITRE ATT&CK T1189: Drive-by Compromise","MITRE ATT&CK T1195: Supply Chain Compromise",{}]