> Only serving the iframe at specific times, presumably when they knew an intended target would be visiting the site.

> In some email campaigns the targets received links with unique IDs. This was potentially used to enforce a one-time-click policy for each link and allow the exploit kit to only be served once.

> The exploit kit would AES encrypt each stage, including the clients’ responses with a session-specific key.

> Additional stages were not served if the previous stage failed.

it was hard to collect the exploits. They only managed to collect the Chrome one.

Compare this to Pegasus, malware that attacks both iOS and Android. So far researchers have only been able to collect iOS versions.

I think it's a little funny that you're complaining that a Google security group (TAG in this case) is publicly reporting vulnerabilities in a Google product, but not others. With Project Zero (a different Google security group), people usually complain in the opposite way, and say that it's bad for Google to publicly report a lot of vulnerabilities in competitor products, because it makes competitors look bad and is just done for publicity reasons.

Disclosure, I work at Google, but not on anything related to this.

Whether that means they didn’t have exploits for other platforms as part of this attack or that we just didn’t succeed in determining them is unknown.

TAG has certainly found and reported exploits in other platforms many times so it is not a matter of not caring.

Source: I am lead of TAG at Google