TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The Citizen Lab reports that targeted online ads delivered Candiru mercenary spyware to devices at Al Jazeera, describing the operation as a zero-click attack called AdFection. It says ad-tech company Discover-Tech enabled the targeting and infection, and that several advertising firms cut off its access after receiving the findings.
The Citizen Lab says targeted online advertisements infected devices at Al Jazeera with mercenary spyware linked to Candiru, now rebranded as Integrity Labs, in what researchers call AdFection. The group describes its findings as the first public technical confirmation of a zero-click mercenary spyware attack delivered through advertising: a device could be targeted and infected when an ad appeared, without the user clicking it.
Researchers attribute the malicious ads to Discover-Tech, an Israeli company that presents itself as an advertising business. The Citizen Lab says the company operates a platform called Controlium, which its report describes as allowing spyware partners to identify users, fingerprint devices and automatically infect them when an ad is rendered. These are findings and characterizations by the researchers; the source material does not include a response from Discover-Tech or Candiru.
The report says analysis of four billion Discover-Tech bidding records found that, over a four-month period, the company’s ads appeared on nearly 200,000 unique websites and Android and iOS apps across dozens of countries. Researchers also say the ads covertly caused millions of devices to contact Candiru servers, likely for tracking or reconnaissance. The scale figures describe the records and activity analyzed; they do not establish that all of those devices were infected.
After the researchers shared their findings, Google, IAB Europe, Beeswax, Vungle (Liftoff) and Eskimi took steps to disconnect Discover-Tech from the advertising ecosystem, according to the report. The Citizen Lab says other vendors it identified did not respond within the time provided. It also reports links between Discover-Tech and other spyware or intelligence actors, including Intelos and Bindecy, and says it is working with vendors on a separate mass-deanonymization operation.
How Ad Auctions Can Enable Spyware
The reported attack matters because it uses an ordinary part of the internet—advertising shown inside websites and apps—as a route for targeted surveillance. In a zero-click scenario, a person may not need to open a suspicious link or approve a download for their device to be exposed. That makes familiar advice about avoiding questionable links inadequate as a complete defense against this reported method.
The findings also point to risks built into real-time advertising auctions. These systems exchange device and user information among multiple parties to select and deliver ads, while ad content can include code that runs in an app or browser. The Citizen Lab argues that the system’s reach and access to detailed data created opportunities for covert targeting and tracking. Its report does not establish that every ad platform or participant was aware of the alleged spyware activity.
Vendor disconnections show that intermediaries can restrict access once concerns are raised, but the report’s account of ads appearing across many sites and apps raises questions about how such activity escaped screening. The researchers call for regulators to investigate whether Discover-Tech and Candiru/Integrity Labs broke applicable laws, and urge action by lawmakers and the advertising industry.
Android iOS device security protection
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
The Ad-Tech Route to Infection
Online ads are often selected through real-time bidding: a website or app offers an ad slot, information about the device and the opportunity is shared with advertising companies, and bids determine which ad appears. The Citizen Lab says auctions take place at enormous scale and may disclose identifiers, device characteristics, location and IP address information to participating parties.
Ads can also contain software code, not just an image or video. According to the report, that combination of detailed targeting data and code running within apps or browsers can be exploited for surveillance. The researchers say Discover-Tech appeared on vendor lists described as certified or approved and served ads through networks including Google, Yandex and Beeswax. They also say it used European Union consent frameworks to target users, although the source material does not detail the specific legal basis or decisions involved.
““We provide the first public technical confirmation of a zero-click mercenary spyware attack delivered via targeted advertising, which we call AdFection.””
— The Citizen Lab
As an affiliate, we earn on qualifying purchases.
Questions About Reach and Responsibility
The report identifies devices at Al Jazeera as infected but the supplied material does not state how many devices were compromised, which individuals were affected, or how long infections lasted. It also does not provide a response from Discover-Tech or Candiru/Integrity Labs, leaving their accounts of the findings unavailable here.
The nearly 200,000 websites and apps figure refers to where Discover-Tech ads appeared during the analyzed period, not confirmed spyware infections. The report says millions of devices were directed to contact Candiru servers and describes that activity as likely tracking or reconnaissance, but the provided findings do not quantify how many people were identified or what data was collected. Legal responsibility and the knowledge of individual advertising vendors have not been established in the source material.
The Citizen Lab says a separate actor, which it calls DARK CARTOGRAPHER, uses Discover-Tech infrastructure to exploit mobile-carrier vulnerabilities and connect advertising IDs with phone numbers. The researchers say they will publish details in a forthcoming report; the full scope and affected parties remain unknown.
privacy protection for smartphones
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Regulatory Review and Further Findings
The Citizen Lab is urging regulators to examine whether Discover-Tech and Candiru/Integrity Labs breached applicable laws. It says it has disclosed findings to advertising vendors and industry organizations and is working with vendors to mitigate the separate DARK CARTOGRAPHER activity. The report’s account says several companies have already cut off Discover-Tech’s access, while other vendors did not respond by the researchers’ stated deadline.
Further developments may include additional vendor responses, regulatory action and the Citizen Lab’s promised report on DARK CARTOGRAPHER. The researchers also offer recommendations to lawmakers, defenders and advertising companies, but the source material does not specify a timetable for investigations or the publication of the next report.
malware detection tools for mobile
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What does AdFection mean?
AdFection is the Citizen Lab’s name for the reported delivery of mercenary spyware through targeted advertising. Researchers say an ad could trigger infection when displayed, without a click.
Which spyware and companies does the report identify?
The Citizen Lab links the reported infections at Al Jazeera to Candiru, rebranded as Integrity Labs, and identifies Israeli ad-tech company Discover-Tech as the alleged advertising intermediary. These are the researchers’ findings; the source material includes no response from the named companies.
Does the report say nearly 200,000 sites were infected?
No. The report says Discover-Tech ads appeared on nearly 200,000 unique websites and apps during a four-month period. That figure is not a count of infected sites or devices.
What action have advertising companies taken?
The Citizen Lab says Google, IAB Europe, Beeswax, Vungle (Liftoff) and Eskimi took steps to disconnect Discover-Tech from the digital advertising ecosystem after receiving its findings. The report says other vendors it contacted did not respond within the stated timeframe.
What remains unknown?
The supplied material does not give the number of infected Al Jazeera devices, identify all affected people or explain what data was collected. It also does not establish legal violations or provide the named companies’ responses.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
