Citizen Lab has identified a new form of spyware, dubbed "Ad Fection," that infects phones and computers through global online advertising networks, according to a new report. Unlike typical attacks, it requires no interaction from victims. Simply displaying a malicious ad can infect a device, with no need to click a link or open a file. The researchers say this is the first confirmation of zero-click, government-backed spyware being delivered through online ads.
The technology was reportedly developed by Israeli company Discover-Tech, which presents itself as a legitimate advertising firm. Citizen Lab says it acts as a bridge between ad vendors and the mercenary spyware ecosystem. Researchers say the spyware has been used to target journalists and staff at Al Jazeera, along with officials and employees at NATO, the European Commission, NVIDIA and Arm. Discover-Tech reportedly displayed 442 million ads on more than 120,000 websites, including the BBC and New York Times, as well as mobile apps like Duolingo, Badoo and Grindr.
Google was among the ad platforms exploited. Following a joint investigation with Citizen Lab and Confiant, the company blocked Discover-Tech from its ad platforms for systematically violating its policies. Discover-Tech's software used real-time bidding auctions to profile and de-anonymize users before serving them malicious code hidden in ads.
Citizen Lab also found login records on Discover-Tech's site, including details belonging to employees of spyware maker Candiru. Senior researcher Bill Marczak called the findings "surely just the tip of the iceberg" and advised anyone who might be targeted to disable ad tracking or block ads altogether. Discover-Tech and other parties involved have yet to comment.
Source: Engadget · Summarized by HeadlinesBriefing