Targeted ads used to deliver 0-click exploits and install mercenary spyware

Targeted advertising is usually associated with intrusive banners and the quiet flow of personal data to advertisers. In the incident described here, however, it served as a channel for something far more dangerous — the delivery of malicious code.

According to Ars Technica, attackers abused targeted-ad mechanisms to deliver so-called 0-click exploits — vulnerabilities that trigger without any action from the victim. There is no link to click and no attachment to open: the compromise happens on its own. The payload was mercenary spyware — the kind of commercial surveillance software that private firms sell to government customers.

What makes the case notable is that it appears to be the first documented confirmation of targeted advertising being used as a delivery vector for such spyware. Ad platforms allow audiences to be selected with great precision — by location, interests, or device. Those same capabilities, built for marketing, turn out to be a convenient tool for pinpoint attacks on specific people, delivering an exploit to a chosen target without drawing attention.

The combination of 0-click vulnerabilities and advertising infrastructure makes such an attack especially dangerous: the victim does not have to make a mistake, and the source of infection hides within ordinary ad traffic, of which there is an enormous amount online.

The incident is another reminder that the commercial spyware industry keeps looking for new delivery methods, and that the familiar machinery of internet advertising can be turned against users.

Source: Ars Technica