A new type of spyware dubbed "Ad Fection" is infecting phones and computers through global online advertising networks, according to a new report from Citizen Lab. The attack is unique in that it can infect devices simply by displaying an ad, requiring no click on a link or opening of a file from the victim.
The researchers said Ad Fection is the first confirmation of zero-click, government-backed spyware attacks being delivered through online ads. The ad-infiltrating technology was reportedly developed by Israeli company Discover-Tech. Researchers said it has been used to target journalists and staff at the Al Jazeera news network, as well as officials and employees at organizations including NATO, the European Commission, NVIDIA and Arm.
"Discover-Tech has leveraged the advertising ecosystem for years to turn trusted websites and popular apps into a zero-click spyware delivery platform," Citizen Lab senior researcher Bill Marczak told the Financial Times. Citizen Lab's report states that Discover-Tech presents itself as a legitimate advertising firm but instead serves as a "bridge between ad vendors and the mercenary spyware ecosystem." Google was among the major ad platforms targeted, but it has since suspended Discover-Tech from its global vendor list for systematically violating its policies.
The software reportedly used real-time bidding auctions to profile and de-anonymize users before targeting them with malicious code hidden in innocent-looking ads. Discover-Tech displayed 442 million ads on more than 120,000 websites, including the BBC and New York Times, along with apps such as Duolingo, Badoo and Grindr. Citizen Lab also found login records on Discover-Tech's site tied to employees of the spyware maker Candiru. Marczak called the discovery "surely just the tip of the iceberg" and advised people who may be targeted to disable ad tracking or block ads altogether. Discover-Tech and other parties in the scheme have yet to comment.
Source: Engadget · Summarized by HeadlinesBriefing