TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Citizen Lab says it technically confirmed a zero-click mercenary spyware attack delivered through targeted online ads, which it calls AdFection. The report links the ads to Israeli company Discover-Tech and spyware maker Candiru, and says several advertising firms have disconnected Discover-Tech.
The Citizen Lab has reported that targeted online advertisements infected devices at Al Jazeera with mercenary spyware linked to Candiru, in what it describes as the first public technical confirmation of a zero-click spyware attack delivered through advertising. The researchers call the technique AdFection and say the ads were purchased by Discover-Tech, an Israeli company they describe as a facilitator for spyware operators.
According to the report, Discover-Tech used a platform called Controlium to identify and fingerprint devices and trigger infection when an ad was rendered, without requiring a user to click. Citizen Lab attributes the spyware in the Al Jazeera cases to Candiru, which has rebranded as Integrity Labs. The report does not provide a public account of every affected device or the full technical chain for each infection in the supplied findings.
Citizen Lab analyzed four billion Discover-Tech bidding records and found that, over a four-month period, the company’s ads appeared on almost 200,000 unique websites and Android and iOS apps across dozens of countries. The researchers also say those ads caused millions of devices to contact Candiru servers, likely for tracking and reconnaissance. That interpretation is attributed to the researchers; the contact count does not by itself establish that all those devices were infected.
The report says Discover-Tech has links beyond Candiru, including to spyware groups identified as Intelos and Bindecy. Citizen Lab also describes a separate actor it calls DARK CARTOGRAPHER, which it says used Discover-Tech infrastructure to exploit mobile-carrier vulnerabilities and connect advertising IDs with phone numbers. The lab says it will publish details of that activity separately and is working with vendors on mitigation.
How Ad Auctions Became Spyware Infrastructure
The findings matter because online advertising was designed to target individual users using information about devices, identifiers, location and the page or app showing an ad. Citizen Lab says that same infrastructure can be repurposed to select targets and run code in an ad slot, turning an ordinary ad view into a potential route for surveillance or infection.
The scale described in the report also raises concerns beyond the Al Jazeera cases. Ads appearing across many sites and apps can expose large numbers of devices to tracking or reconnaissance, while users and publishers may not know which intermediaries handled a particular impression. Citizen Lab argues this reflects structural weaknesses in ad-system oversight; that is the researchers’ assessment, not a finding by a regulator.
The report says Google, IAB Europe, Beeswax, Vungle (Liftoff) and Eskimi took action to disconnect Discover-Tech from the digital advertising ecosystem after receiving the researchers’ findings. Those steps may limit access through the named services, but the report does not establish that every route available to the company or its partners has been closed.
Android iOS device security protection
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The Advertising Pipeline Behind AdFection
Most digital ads are placed through real-time bidding. When a website or app requests an ad, information about the user, device and available ad space can be shared with advertising intermediaries, which bid to show an impression. The process takes place rapidly and can involve multiple companies. Citizen Lab notes that ad content can also contain code that runs in the browser or app, beyond a static image or video.
The report says Discover-Tech appeared on lists of certified or approved vendors maintained by Google and IAB Europe and served ads through major networks, including Google, Yandex and Beeswax. It also says the company used European Union consent frameworks to target users. These details help explain how the reported activity could reach a broad set of apps and sites; inclusion on a vendor list does not establish that an organization endorsed the alleged spyware activity.
Citizen Lab says it disclosed its findings to advertising vendors and industry organizations. It calls on regulators to investigate whether Discover-Tech and Candiru/Integrity Labs violated applicable laws, and offers recommendations for lawmakers, defenders and the advertising sector.
““the first public technical confirmation of a zero-click mercenary spyware attack delivered via targeted advertising””
— The Citizen Lab
As an affiliate, we earn on qualifying purchases.
What the Public Findings Do Not Establish
The report identifies Al Jazeera devices as infected but the supplied findings do not state how many devices were compromised, the identities of affected users, or the full duration and consequences of the infections. It is also not clear from the material provided whether the attacks affected organizations beyond Al Jazeera.
Citizen Lab says millions of devices were directed to contact Candiru servers and describes that activity as likely tracking and reconnaissance. That figure is not a count of confirmed infections, and the report’s interpretation of the contacts should not be treated as proof that every device was monitored. The researchers’ claims about Discover-Tech’s relationships with other spyware actors and DARK CARTOGRAPHER also require careful attribution; the separate DARK CARTOGRAPHER findings have not yet been detailed in the report summarized here.
The report calls for legal investigation, but no regulator’s findings or court ruling are included in the supplied material. Discover-Tech’s response is also not provided. Citizen Lab says some vendors did not respond to its requests for comment within the stated timeline.
As an affiliate, we earn on qualifying purchases.
Vendor Mitigations and Further Reporting
Citizen Lab says it is working with advertising vendors to mitigate the DARK CARTOGRAPHER activity and plans a separate report detailing that threat actor’s alleged use of carrier vulnerabilities. It has also urged regulators to examine whether Discover-Tech and Candiru/Integrity Labs broke applicable laws.
Further developments to watch include whether additional ad companies restrict Discover-Tech, whether regulators open investigations, and whether the spyware operators or the company respond publicly. The report does not give a timetable for those steps, so the status of any formal inquiry remains unknown.
malware detection software for smartphones
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is AdFection?
AdFection is the name Citizen Lab gives to a reported spyware delivery method in which a targeted advertisement can trigger device fingerprinting and infection without a click.
Who does Citizen Lab link to the Al Jazeera infections?
The researchers attribute the spyware to Candiru, which has rebranded as Integrity Labs, and say the ads were purchased by Discover-Tech. These are findings reported by Citizen Lab, not a court or regulator’s conclusion.
Does the report say millions of devices were infected?
No. Citizen Lab says ads covertly directed millions of devices to contact Candiru servers, likely for tracking and reconnaissance. That is distinct from a confirmed count of infected devices.
Which advertising companies took action?
Citizen Lab says Google, IAB Europe, Beeswax, Vungle (Liftoff) and Eskimi took action to disconnect Discover-Tech’s access to the advertising ecosystem after receiving the findings.
What is still unknown?
The supplied findings do not give the number of compromised Al Jazeera devices, identify affected users, or establish the full effects of the infections. The report also does not provide Discover-Tech’s response or details of any regulatory investigation.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
