Oh joy, zero-click ad spyware is here

Citizen Lab delightfully revealed that Discover-Tech's ad plumbing was repurposed to lob Candiru spyware straight onto Al Jazeera staff devices without requiring a single click. In what is surely just another Tuesday in IT, attackers used Real-Time Bidding networks and advertising IDs to fingerprint high-profile targets. To shield your own gear from this charming mess, one would have to stop malicious advertisements from rendering entirely, because apparently even background ad rendering is now an open invitation for state-grade espionage.