Comment by boston_clone
4 days ago
> they attribute to the ads based on the DLL hard-coding some domains related to the ad campaign
No, their attribution is much more robust than this. Neglecting those details to oversimplify your explanation is intellectually dishonest.
> there is nothing explaining how the DLL becomes zero-click compromised [...]
They do, just a little later in that same section: "Both samples use a COM hijack for persistence [...]" through a malicious DLL.
> No, their attribution is much more robust than this. Neglecting those details to oversimplify your explanation is intellectually dishonest.
I completely and fundamentally disagree that there is such a robust attribution. I read the section thoroughly and my explanation is not at all oversimplified. Please cite the details that you believe to be relevant here.
> They do, just a little later in that same section: "Both samples use a COM hijack for persistence [...]" through a malicious DLL.
This is not even remotely an explanation of what happened. Giving a name to a phenomenon does not explain it. This does not say how the COM hijack is effected; it does not say how any code escapes the browser sandbox at all; it does not point at a browser vulnerability. Even following through a link to their previous article, the only CVE citations they give are for local privilege escalations (which are described in a very generic way in the CVE database) which would still require a sandbox escape. And even then, it isn't necessarily relevant, as they merely claim "The functionality broadly overlaps with the functionality of the Candiru chain from our 2021 report."