Citizen Lab says an Israeli ad company delivered Candiru spyware to Al Jazeera devices through targeted ads
In the operation Citizen Lab calls AdFection, ads bought by Discover-Tech were used to fingerprint and track devices at scale and infect chosen targets without a single click.
Evidence: Official disclosure. Security stories run only with a named disclosure or independent reporting behind them.
Citizen Lab, the Canadian internet watchdog, reports that Candiru spyware infected devices at the international news network Al Jazeera in zero-click attacks delivered through targeted advertising. SecurityWeek covered the findings, and Security Affairs listed the report in its malware newsletter. Citizen Lab calls the operation AdFection. It says ads bought by Discover-Tech, an Israeli company that looks like a legitimate advertiser, were used to de-anonymize, fingerprint and infect users, and to track millions of devices. Citizen Lab concludes the firm is likely a front for a large spyware and espionage campaign that links ad vendors with spyware vendors. The attack relies on how online advertising normally works. Companies bid in billions of real-time bidding auctions every day for the chance to show an ad to a particular user. Ad exchanges collect detailed device and user data, and ads can carry code that runs inside the user's app or browser. Citizen Lab says that combination lets an operator pick out specific people and serve them malicious code. Journalists and others targeted by commercial spyware are the people most directly at risk. The findings also put pressure on ad exchanges, which in this case gave a spyware operator both the targeting data and the delivery channel.