[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0dPgN3dBskAnt5330PcWdSFcl1BK4O_tk-P6tPeVkuI":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":63},"7444d88c-af59-4255-a3dc-0600375367ef","ad-network-used-as-zero-click-spyware-delivery-channel-via-real-time-bidding","a40723a3-345d-42ad-ad0e-68933e72dfd9","Ad Network Used as Zero-Click Spyware Delivery Channel via Real-Time Bidding","Discover-Tech, an Israeli advertising firm, secretly operated as a delivery mechanism for Candiru's commercial spyware by weaponizing the Real-Time Bidding (RTB) ecosystem — a trusted advertising infrastructure used by millions of websites. Because RTB auctions execute code silently and at massive scale, threat actors were able to de-anonymize, fingerprint, and infect devices without any user interaction, making traditional awareness-based defenses irrelevant. This highlights the inherent danger of trusting third-party ad supply chains, where a single compromised or complicit intermediary can compromise millions of endpoints globally. Organizations and individuals have no direct visibility into the ad code executing in their browsers, creating a silent attack surface that is extraordinarily difficult to detect or remediate.","**Immediate actions:**\n- Block or restrict real-time bidding ad scripts across enterprise browsers using content security policies (CSP) and ad-blocking solutions.\n- Audit and limit third-party JavaScript execution on all organizational web properties and endpoints.\n\n**Long-term improvements:**\n- Implement a rigorous third-party vendor risk assessment process that includes advertising technology partners and their downstream supply chains.\n- Deploy browser isolation technology to prevent malicious ad scripts from reaching the underlying operating system or network.\n- Establish a continuous inventory of all third-party code and SDKs running within your digital ecosystem.\n\n**Detection measures:**\n- Enable network-level monitoring and DNS filtering to flag anomalous outbound connections triggered by advertising platforms.\n- Integrate threat intelligence feeds that track known spyware-as-a-service vendors (e.g., Candiru, NSO Group) and their associated infrastructure into SIEM alerting rules.\n- Conduct regular endpoint behavioral analysis to detect zero-click exploit indicators such as unexpected process spawning from browser contexts.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-161: Supply Chain Risk Management","NIST CSF DE.CM-7: Monitoring for Unauthorized Personnel, Connections, Devices, and Software","NIST SP 800-53 SC-18: Mobile Code","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","GDPR Article 25: Data Protection by Design and by Default","GDPR Article 32: Security of Processing","MITRE ATT&CK T1189: Drive-by Compromise","MITRE ATT&CK T1195: Supply Chain Compromise",{},"published","2026-10-17T12:20:32.332264+00:00","2026-10-17T12:20:32.316+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fwww.securityweek.com\u002Fisraeli-ad-firm-doubled-as-candirus-zero-click-spyware-delivery-channel\u002F","israeli-ad-firm-doubled-as-candiru-s-zero-click-spyware-delivery-channel-dc7947","Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":39,"name":40,"slug":41,"description":42,"color":43},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",{"id":45,"name":46,"slug":47,"description":48,"color":49},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[51,57],{"id":52,"date":53,"edition":54,"title":55,"audio_url":56},"f11b3a67-3f7a-4470-8f85-93100bc16c1b","2026-10-18","morning","ThreatNoir Weekend Brief — October 18","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-10-18\u002Fthreatnoir-morning-brief-2026-10-18.mp3",{"id":58,"date":59,"edition":60,"title":61,"audio_url":62},"5bfd8efd-bbf0-427e-a12e-8abbb056097d","2026-10-17","afternoon","ThreatNoir Weekend Brief — October 17","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-10-17\u002Fthreatnoir-afternoon-brief-2026-10-17.mp3",[64,68,72],{"slug":65,"name":66,"problem":67},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":69,"name":70,"problem":71},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",{"slug":73,"name":74,"problem":75},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]