[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQQp5cMbWsbYsNEXdsh_cE26bz-NgoyfHRAdhdl0jtZY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":25,"status":26,"created_at":27,"published_at":28,"article":29,"tags":33,"podcasts":52,"controls":65},"145545b0-30ea-4587-98f0-a9e40ef1d304","zero-click-ad-spyware-bypasses-user-interaction-to-compromise-devices","85050e46-f281-44fa-9a1b-22d585b931f7","Zero-Click Ad Spyware Bypasses User Interaction to Compromise Devices","The AdFection attack demonstrates that simply rendering a malicious advertisement — without any click or user interaction — is sufficient to deliver sophisticated spyware like Candiru to targeted devices. This exploits the implicit trust organizations place in third-party ad networks and the underlying browser\u002FOS vulnerabilities they leverage. The involvement of a commercial surveillance vendor (Discovere-Tech) highlights the growing supply chain risk posed by the ad-tech ecosystem. At scale, millions of users can be silently compromised before any indicator of attack is detected, making traditional user-education defenses entirely ineffective here. Organizations must treat ad rendering as an active attack surface, not a passive content delivery mechanism.","**Immediate actions:**\n- Deploy ad-blocking and script-blocking technologies (e.g., uBlock Origin, Pi-hole) across all endpoints and browsers to prevent malicious ad rendering.\n- Apply all pending OS and browser security patches immediately, as zero-click exploits commonly target unpatched rendering engines.\n- Isolate high-value targets (journalists, executives, researchers) on hardened, ad-free browsing environments or dedicated virtual machines.\n\n**Long-term improvements:**\n- Vet and restrict third-party ad network integrations through a formal supply chain risk management process.\n- Enforce browser hardening baselines (disable JIT compilation, restrict WebAssembly, enable site isolation) via endpoint management tools.\n- Implement network-level DNS filtering and web proxy inspection to block known malicious ad-serving infrastructure before content reaches endpoints.\n\n**Detection measures:**\n- Deploy endpoint detection and response (EDR) tools capable of identifying anomalous process spawning triggered by browser rendering activity.\n- Enable centralized logging of outbound network connections from browsers to detect beaconing to known spyware C2 infrastructure.\n- Conduct regular threat hunting exercises focused on fileless and in-memory compromise indicators consistent with commercial spyware behavior.",[12,13,14,15,16,17,18,19,20,21,22,23,24],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 7 – Continuous Vulnerability Management","CIS Control 9 – Email and Web Browser Protections","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 SA-9 – External System Services (Supply Chain)","NIST SP 800-53 SC-18 – Mobile Code","NIST SP 800-53 RA-5 – Vulnerability Monitoring and Scanning","NIST CSF DE.CM-1 – Network Monitoring","GDPR Article 32 – Security of Processing","GDPR Article 25 – Data Protection by Design and by Default","MITRE ATT&CK T1189 – Drive-by Compromise","MITRE ATT&CK T1195 – Supply Chain Compromise",{},"published","2026-10-16T18:20:36.577683+00:00","2026-10-16T18:20:36.559+00:00",{"id":7,"url":30,"slug":31,"title":32},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fzero-click-attacks-used-targeted-ads-to-deliver-candiru-spyware\u002F","zero-click-attacks-used-targeted-ads-to-deliver-candiru-spyware-f10c7f","Zero-click attacks used targeted ads to deliver Candiru spyware",[34,40,46],{"id":35,"name":36,"slug":37,"description":38,"color":39},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":41,"name":42,"slug":43,"description":44,"color":45},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":47,"name":48,"slug":49,"description":50,"color":51},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[53,59],{"id":54,"date":55,"edition":56,"title":57,"audio_url":58},"bb926e2e-b48f-4dee-ada0-615579680dd0","2026-10-18","afternoon","ThreatNoir Weekend Brief — October 18","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-10-18\u002Fthreatnoir-afternoon-brief-2026-10-18.mp3",{"id":60,"date":61,"edition":62,"title":63,"audio_url":64},"db466008-af33-4c69-a4f3-3063e4a21903","2026-10-17","morning","ThreatNoir Weekend Brief — October 17","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-10-17\u002Fthreatnoir-morning-brief-2026-10-17.mp3",[66,70,74],{"slug":67,"name":68,"problem":69},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":71,"name":72,"problem":73},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":75,"name":76,"problem":77},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home."]