Targeted ads delivered zero-click spyware to Al Jazeera devices
Citizen Lab disclosed technical evidence of spyware reaching devices through targeted advertisements without a click. Its investigation identifies Discover-Tech as an intermediary for commercial spyware suppliers and concludes that Al Jazeera devices were infected with Candiru. The attack separates ordinary-looking advertising from the later delivery of malicious code, complicating detection.
Artificial Intelligence··Evening
Advertisements opened a path to infection
The University of Toronto’s Citizen Lab disclosed AdFection, a technique that delivers commercial spyware through targeted advertisements without requiring a click. Its investigation identifies Israel-based Discover-Tech as an intermediary for spyware suppliers, including Candiru.[1], [2]
Researchers concluded with high confidence that devices at the Al Jazeera media network were targeted and infected with Candiru. The newly disclosed work provides technical evidence of real-world infection through advertising.[1]
A benign-looking ad preceded malicious code
The first advertisement need not contain exploit code. It sends a device’s advertising identifier and IP address to Discover-Tech servers. A selected target later receives malicious JavaScript, code executed in a browser or application. Separating the stages helps the advertisement appear benign. Researchers describe a platform called Controlium through which this arrangement is offered to spyware providers.[1]
Advertising platforms cut off access
An analysis of billions of advertising bids found millions of devices across dozens of countries directed to profiling or infection infrastructure. An ad impression alone does not establish infection. Citizen Lab says Google and IAB Europe removed Discover-Tech from vendor lists, while Google and Beeswax terminated its access to advertising systems. The investigators have not identified every customer or government behind attacks.[1]
