2026-10-17 18:22 UTC
@DaveMWilburn@infosec.exchange @zackwhittaker@mastodon.social @citizenlab@mastodon.social as far as I've been able to find, the ad surveillance system via browser is used to *activate* preexisting malware on the machine. Eg you already have some malicious DLL or something, and (somehow) code sent to the browser activates that. The "novel" part is using ad surveillance to identify specific individuals so you can decide whether to send the "trigger malware" JS in the response.
Replies (1)
-
@dirtside@phpc.social 2026-10-17 18:24
@DaveMWilburn@infosec.exchange @zackwhittaker@mastodon.social @citizenlab@mastodon.social since even a secure browser sandbox does have ways to let JS indirectly cause OS interactions (to support legit functionality like filesystem operations), if the part of the OS activated by that is infected, then JS can in theory trigger the malware without the user doing anything more than visiting a website. But the term "zero-click" implies that an UNINFECTED machine can become infected just by visiting a website, which appears to be false.