Ads Kill: Researchers have uncovered what may be the first instance of a "zero-click" spyware attack. The malicious cyber operation is linked to an Israeli advertising organization that allegedly abused online ads to target a prominent international media company based in Qatar.
A new investigation by Citizen Lab has uncovered a large-scale covert operation designed to install spyware through online advertising. Dubbed "AdFection" by the University of Toronto research unit, the technique was allegedly used by unidentified Israeli actors to infect computers belonging to Al Jazeera's news network.
Citizen Lab said their research provides the first public confirmation that zero-click spyware attacks are possible and are already being exploited in malicious operations. More specifically, the AdFection technique was used by Discover-Tech, an Israeli advertising company, to facilitate the spread of spyware or carry out other malicious activities.
Discover-Tech provides a platform called Controlium, which its advertising partners can allegedly abuse to de-anonymize and identify their targets. Controlium also serves as a "doorway" through which third parties can potentially infect computers. No specific user interaction is required: the platform can allegedly download and execute a malicious tool such as Candiru, a commercial spyware product that Citizen Lab found on Al Jazeera's machines.
According to the researchers, Discover-Tech's advertising was served across approximately 200,000 unique websites and mobile apps in multiple countries. These ads were designed to direct millions of users to servers associated with Candiru. This large-scale tracking and reconnaissance operation was then used to identify and infect selected targets.
Discover-Tech is listed among Google's "certified" advertising vendors and is also described as a GDPR-compliant company operating in European countries. Furthermore, Citizen Lab identified a second threat actor, dubbed "Dark Cartographer," that was working with the Israeli advertising platform. This group was primarily interested in exploiting security vulnerabilities affecting mobile carriers to de-anonymize internet users on a large scale.
According to Citizen Lab researcher Wolfie Christl, major advertising vendors and corporations appeared uninterested in detecting or preventing abuse by malicious Israeli actors. The entire online advertising ecosystem should now be considered a security threat to governments, private organizations, and ordinary users alike, Christl said.
The Canadian report documents a malicious technique that researchers have long considered a potential cybersecurity threat. The newly documented AdFection method can be used to identify and compromise specific targets with considerable precision. Authorities around the world should now investigate the operation and consider appropriate legal action against those responsible.