Al Jazeera journalists targeted by spyware through online ads
Online ads may be watching you.
Al Jazeera. Photo by Robson90/Shutterstock
Follow us
- Citizen Lab says malicious ads infected at least 45 Al Jazeera devices with Candiru spyware.
- Discover-Tech’s ads appeared in about 200,000 apps and websites across several countries.
- Researchers say the attacks needed no clicks and exposed flaws in online advertising systems.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Cybersecurity researchers have uncovered an operation that turns online ads into a zero-click spyware delivery system.
The technique, dubbed “AdFection,” was used to infect at least 45 devices belonging to journalists at the international news network Al Jazeera with mercenary spyware from Candiru, now rebranded as Integrity Labs.
The malicious advertisements were purchased by Discover-Tech, an Israeli company that promotes itself as a legitimate advertising company. In reality, the firm operates as a facilitator for numerous mercenary spyware partners, researchers from The Citizen Lab at the University of Toronto say.
The Israeli ad company offers a platform called “Controlium” for targeting individuals via advertisements. Through this platform, spyware vendors can automatically de-anonymize digital fingerprints and infect them with spyware as soon as an advertisement is displayed on the system.
According to a study conducted by researchers at The Citizen Lab, Discover-Tech’s advertisements were served in approximately 200,000 unique Android and iOS apps and websites across numerous countries, including Armenia, Bosnia, Denmark, Egypt, Kazakhstan, Montenegro, Pakistan, Serbia, and Yemen.
The ads were not only used to infect targets with spyware. Millions of systems worldwide were redirected to servers belonging to the spyware vendor Candiru, presumably for large-scale tracking and reconnaissance.
A separate threat actor, “Dark Cartographer,” is using Discover-Tech’s infrastructure to exploit multiple telecom providers and link phone advertising IDs to phone numbers. The researchers are calling it a “mass-deanonymizing of internet users.”
Details of the threat actor’s attack methods will be discussed in a future report.
No interaction required
The spyware infection requires no interaction whatsoever from the victims. On top of that, Discover-Tech has served ads on practically every major search engine platform, such as Google, Yandex, and Beeswax.
“Discover-Tech’s mass abuse, privacy invasion, and facilitation for mercenary spyware attacks illustrate structural flaws with the online advertising system, which failed to detect or prevent the abuse documented in this report,” The Citizen Lab warns.
People who want to protect themselves against these types of attacks are recommended to block online advertisements.
The Citizen Lab has shared its findings with several ad vendors. Several advertising companies, including Google, IAB Europe, Beeswax, Vungle, and Eskimi, have since revoked Discover-Tech's access to their advertising platforms.
