Ad Network Used as Zero-Click Spyware Delivery Channel via Real-Time Bidding
Discover-Tech, an Israeli advertising firm, secretly operated as a delivery mechanism for Candiru's commercial spyware by weaponizing the Real-Time Bidding (RTB) ecosystem — a trusted advertising infrastructure used by millions of websites. Because RTB auctions execute code silently and at massive scale, threat actors were able to de-anonymize, fingerprint, and infect devices without any user interaction, making traditional awareness-based defenses irrelevant. This highlights the inherent danger of trusting third-party ad supply chains, where a single compromised or complicit intermediary can compromise millions of endpoints globally. Organizations and individuals have no direct visibility into the ad code executing in their browsers, creating a silent attack surface that is extraordinarily difficult to detect or remediate.
Tactical Insight
Immediate actions
- Block or restrict real-time bidding ad scripts across enterprise browsers using content security policies (CSP) and ad-blocking solutions.
- Audit and limit third-party JavaScript execution on all organizational web properties and endpoints.
Long-term improvements
- Implement a rigorous third-party vendor risk assessment process that includes advertising technology partners and their downstream supply chains.
- Deploy browser isolation technology to prevent malicious ad scripts from reaching the underlying operating system or network.
- Establish a continuous inventory of all third-party code and SDKs running within your digital ecosystem.
Detection measures
- Enable network-level monitoring and DNS filtering to flag anomalous outbound connections triggered by advertising platforms.
- Integrate threat intelligence feeds that track known spyware-as-a-service vendors (e.g., Candiru, NSO Group) and their associated infrastructure into SIEM alerting rules.
- Conduct regular endpoint behavioral analysis to detect zero-click exploit indicators such as unexpected process spawning from browser contexts.