GOS+Vanadium vs zero-click malware from targeted ads via JavaScript

science

As many here know, disabling JavaScript in the browser will break many popular and important websites.

But as was reported today, it is confirmed that zero-click malware has been recently distributed at scale through targeted ads and JavaScript.

Can anyone offer an informed opinion on whether Vanadium (with JavaScript ON) + GOS sandboxing could be sufficient to prevent infection from this type of malware?

https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Candiru’s spyware. We also uncover Discover-Tech, and show how the company helps mercenary surveillance vendors track and hack devices around the world. [...]

Advertisers or DSPs may run HTML and JavaScript code when an ad is shown to the user. That code retrieves additional JavaScript code, which may, in turn, load further code, such as a browser exploit to install spyware. Since the code can contain identifiers for the user or their device, arbitrary JavaScript code can be sent precisely to a single user’s device. Our research in this report indicates that this architecture is indeed abused to facilitate the delivery of zero-click targeted spyware, and that the simple display of a targeted ad is enough for infection. [...]

Ads with attacker script tags were shown to users of 75,373 different Android and iOS apps and to visitors of 120,768 different websites in mobile and desktop browsers. These numbers refer to ads actually displayed to users of apps and websites rather than raw bids. [...]

Our analysis indicates that Discover-Tech deployed ads via Google, Yandex, and other ad vendors including Beeswax (FreeWheel/Comcast), Vungle (Liftoff), Eskimi, and Sunteng. In addition, both Google and the advertising association IAB Europe have listed Discover-Tech as a “certified” and “approved” ad vendor since the year 2020, which helped make the company appear to be a legitimate advertising firm and facilitate its participation in the advertising ecosystem at scale.

userofgos

science it may or may not be related to this thread: #42752

de0u

science Can anyone offer an informed opinion on whether Vanadium (with JavaScript ON) + GOS sandboxing could be sufficient to prevent infection from this type of malware?

I skimmed the report... and I don't think I can offer an opinion. Maybe I missed the part where it says which vulnerabilities were exploited?

guser39

de0u Maybe I missed the part where it says which vulnerabilities were exploited?

Per: https://infosec.exchange/@mttaggart/117446952630238750

There are no vulnerabilities exploited. This is not Pegasus 2.0. It's straight-ahead JS injection. Same trick as BeEF. In fact, Confiant even calls out that the iframe mechanism described limits what the Candiru payload can do.

de0u

guser39 Thanks. So far it sounds like an advanced platform for serving JavaScript that does whatever JS does. It sounds as if it can do mouse tracking, keystroke capture in some cases (if a user types at the right window), fingerprinting, etc.

If that's right, then if the JS code served to a given browser is designed to exploit a vulnerability that browser has, then the device could be exploited. But this is also true of any web site one might visit (if, hypothetically, discuss.grapheneos.org served malicious JS then people visiting the site would run the malicious JS).

Compared to other browsers, Vanadium on GrapheneOS has a lot of hardening. So the tracking and fingerprinting parts of the described effort would work, but I don't think we know whether or not any Vanadium exploits were tried, let alone worked.

mulfi

I guess ublock and adblocking dns would prevent this kind of thing, right?

NoahRaketic

mulfi Request filtering based ad blocking may reduce some of it, but it's not a preventative measure.

guser39

mulfi I think uBlock adds additional protections around iframes that are abused here but I don't know enough to do more than speculate. I do know uBlock often shows up blocking iframe content for me on ad-ridden sites, which is relevant here.

dryfter

NoahRaketic What about RethinkDNS or AdGuard? Technically it is request filtering based ad blocking, but there's a lot of DNS and other stuff involved with those as well.

Hande

I think this is a bit of a nothing burger, if one is using an up-to-date and safe browser JavaScript is very unlikely to be able to infect anything or cause any real damage even when malicious. That's kind of how it's meant to work and JS spyware in ads or wherever is nothing new. I think most of us have seen Google / Facebook etc. ads and how little they care about protecting the users from scams, apply this to any website that serves ads from whatever source.

It probably doesn't hurt to filter traffic on a network level even if it isn't a perfect solution to this. Adblockers may be fine also assuming they don't just create more attack surface. But just keep your stuff up to date, use a secure browser and the chances of this kind of stuff doing much else than basic fingerprinting are quite low. For your average user anyway; if you are a targeted journalist or something similar the stakes could be a bit higher even if it's "just" fingerprinting.

GrapheneOS

mulfi No, neither prevents it. Reducing the number of ads by blocking known patterns does not completely eliminate ads or especially overall third party content. Third party content can also be included server side.

Vanadium has default enabled ad blocking so adding DNS filtering won't generally improve much for the default browser. The in-browser filtering can block more than DNS filtering.

Meatheadmarty

GrapheneOS

Do you know or understand if the malware they served was persistant and could bypass sandboxing by GOS?

For example I run Tor Browser often with javascript on when using GOS so I can browse without finberprint tracking. (However, since this js attack was served to certain fingerprint it coukd have been sent to Tor Browser fingerprints.) This was also primarily a mobile attack. Could I have been infected?

I know they tried to exploit WebRTC for some users, but the reporting is too confusing or I am too slow to understand if this may have resulted in persistent malware.

de0u

Meatheadmarty Do you know or understand if the malware they served was persistant and could bypass sandboxing by GOS?

I may have missed it, but I didn't see a description or analysis in the Citizen Lab report. Perhaps they didn't capture any, or perhaps they will report on that later.

Without an analysis of the malware, there is no way to know what it might have done.

science

More reporting about the actual malware, apparently it:

bootstraps an SDK that looks like a verification script, ostensibly a bot detection of some kind, or other verification layer as is commonly found in ad tech. The “SDK” itself is loaded via script tag sdk.js?script_tok=91a9788a4e7576a17806bf3af0a8b07043b779f8… and comes back with about 90KB of obfuscated JavaScript, likely obfuscated with the open source tool javascript-obfuscator.

The full payload comes to over 3,700 lines of code when beautified, making it out of scope for a line-by-line analysis here, but we’ll share our observations and inferences below. [...]

The operator can also push arbitrary code, which the SDK compiles and runs by wrapping it in a new Function(...) call. Combined with the SDK’s ability to capture a comprehensive device fingerprint, this is an effective mechanism for the surgical delivery of high-impact payloads such as browser exploits. All code delivered is executed with the authority of the context in which the SDK is invoked, in this case an ad frame. [...]

Discover-Tech serves roughly 10 million ad impressions a day, and each one feeds an identity graph built from device fingerprints, IP addresses, advertising IDs, and often the publisher’s own first-party cookies. That is passive surveillance on a global scale. From that pool, the operator picks out individual devices, some of them on government networks, and sends them code that nobody else receives.

https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming

Another notable source for context about the threat actors:
https://www.reuters.com/legal/litigation/israeli-firm-used-online-ads-run-vast-spy-operation-researchers-say-2026-10-15/

de0u

science More reporting about the actual malware [...]

The "SDK" is not something that would break out of the sandbox and exfiltrate data, or leave a persistent implant. It is the "payload" that might theoretically do that. That's this part of the quote: "The operator can also push arbitrary code, which the SDK compiles and runs by wrapping it in a new Function(...) call. Combined with the SDK’s ability to capture a comprehensive device fingerprint, this is an effective mechanism for the surgical delivery of high-impact payloads such as browser exploits". Without an analysis of the "payload" (the "browser exploit" part) it's not possible to answer the original question about Vanadium's sandboxing and hardening and GrapheneOS's sandboxing and hardening.

science Another notable source for context about the threat actors:
https://www.reuters.com/legal/litigation/israeli-firm-used-online-ads-run-vast-spy-operation-researchers-say-2026-10-15/

That does discuss one payload: "Citizen Lab said a powerful form of Candiru spyware delivered through Discover-Tech's ads had been used to compromise 45 Windows devices at the Qatari broadcaster Al Jazeera between 2024 and 2025, something it said it was able to confirm because the media group had shared its network logs with the group" (emphasis added). Until there is analysis of a payload designed to attack Android devices (which may well have existed), it's not possible to say whether or not such a payload would have been defeated by Vanadium or GrapheneOS.

Again, it is possible that Citizen Lab doesn't have an Android payload, or that they do have one but aren't yet reporting on it. But without such an analysis the original question can't really have an answer.

Handlebar6933

de0u Exactly. I was excited for the long form article because I thought they would go into the technical details, TTPs, etc. but I skimmed through it and couldnt find any.

de0u

Handlebar6933 I was excited for the long form article because I thought they would go into the technical details, TTPs, etc. but I skimmed through it and couldnt find any.

Hopefully that may come later.

science

de0u

analysis of a payload designed to attack Android devices

Looks like there's another article by Citizen Lab reporting on claimed capabilities:

A leaked Candiru project proposal published by TheMarker shows that Candiru’s spyware can be installed using a number of different vectors, including malicious links, man-in-the-middle attacks, and physical attacks. A vector named “Sherlock” is also offered, that they claim works on Windows, iOS, and Android. This may be a browser-based zero-click vector. [...]

The proposal states that the spyware can exfiltrate private data from a number of apps and accounts including Gmail, Skype, Telegram, and Facebook. The spyware can also capture browsing history and passwords, turn on the target’s webcam and microphone, and take pictures of the screen. Capturing data from additional apps, such as Signal Private Messenger, is sold as an add-on.

For a further additional €1.5M fee, customers can purchase a remote shell capability, which allows them full access to run any command or program on the target’s computer. This kind of capability is especially concerning, given that it could also be used to download files, such as planting incriminating materials, onto an infected device.

Granted, the report quoted above is stale (2021) and lacks full details about android compatibility.

But it seems that there have historically been some very serious Android payloads on offer from this threat actor.

Interesting to note that the payload deployments reported there are very expensive and small scale (10-50 concurrent spyware victims at any one time).

But the targeting infrastructure / vector / zero-click ad infections are at a much larger scale (200,000+ per the more recent citizen labs article).

The €16 million project proposal allows for an unlimited number of spyware infection attempts, but the monitoring of only 10 devices simultaneously. For an additional €1.5M, the customer can purchase the ability to monitor 15 additional devices simultaneously, and to infect devices in a single additional country. For an additional €5.5M, the customer can monitor 25 additional devices simultaneously, and conduct espionage in five more countries.

https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/

de0u

science Granted, the report quoted above is stale (2021) and lacks full details about android compatibility.

But it seems that there have historically been some very serious Android payloads on offer from this threat actor.

Indeed. And also Cellebrite etc. have gotten into a lot of phones via USB-C, Wi-Fi, Bluetooth, etc.

No news so far on GrapheneOS. This is consistent with them being unable, but also consistent with any hypothetical GrapheneOS exploits being too valuable to deploy widely (to go back to the original question). In general, most exploits that work on most Android devices -- which are typically far behind on security updates -- probably don't work on up-to-date GrapheneOS devices.

Meatheadmarty

science well ill probably get banned for this because i was just warned byva mod to never discuss my personal views without hard evidence, but my flashlight on gos was turned on without my permission before which i thought meant someone had tried to access camera and didn't see anything so turned on flashlight. It's been fun spending time here, goodbye everyone.