Citizen Lab Reports Spyware Delivered Through Targeted Online Ads Without User Interaction
Summary
Citizen Lab says Discover-Tech’s targeted ads helped Candiru spyware reach at least 45 Al-Jazeera devices. The researchers describe a zero-click ad-delivery technique and report that several ad platforms cut off Discover-Tech.
Key points
- Citizen Lab reported that Discover-Tech allegedly used targeted ads to help spyware vendor Candiru infect at least 45 devices belonging to Al-Jazeera personnel.
- The reported technique, dubbed AdFection, can deliver spyware when an ad renders, without a user clicking or taking another action.
- In the described chain, an ad tag contacts a Discover-Tech-controlled server, which checks device identifiers and may return JavaScript; logs supplied by Al-Jazeera showed contacts with Discover-Tech infrastructure and Candiru servers.
- Citizen Lab said Discover-Tech served ads across almost 200,000 unique websites and Android and iOS applications over four months, but stressed that ad impressions alone do not establish targeting or infection.
- Citizen Lab identified Candiru as the strongest case in its technical evidence of spyware infections delivered through targeted ads; it also linked Discover-Tech to other surveillance players.
- Google terminated Discover-Tech’s access to its ad exchanges, while IAB Europe and several ad-tech platforms removed, blocked, or paused its access.
- Citizen Lab recommended that organizations consider blocking targeted ads at network gateways and that government agencies deploy ad blockers and disable unique advertising IDs on government mobile devices.
Article Details
- Event Type
- Reported zero-click spyware delivery through targeted online advertising
- Impact
- Citizen Lab reported that Discover-Tech allegedly used targeted ad impressions to help Candiru deliver spyware without user interaction. Network logs supplied by Al-Jazeera showed infected devices contacting Discover-Tech infrastructure, Candiru validator servers, and a Candiru command-and-control server. At least 45 Al-Jazeera personnel devices were reportedly infected. Ad impressions alone do not confirm targeting or infection; the report also identified broader risks to users and organizations exposed to the advertising ecosystem.
Threat Actors
CandiruSpyware vendor that Citizen Lab said was involved in infections allegedly delivered through Discover-Tech's targeted ads; the article says Candiru now calls itself Integrity Labs.DARK CARTOGRAPHERThreat actor tracked by Citizen Lab; researchers found indications that it exploited mobile-carrier systems in more than 30 countries to link device advertising IDs with phone numbers.
Vendors
Candiruan ad-tech company called Discover-Tech allegedly used the AdFection technique to help spyware vendor Candiru infect at least 45 devices belonging to personnel at international news organization Al-Jazeera. Candiru,Discover-TechIn a recent report, the researchers detailed how an ad-tech company called Discover-Tech allegedly used the AdFection technique to help spyware vendor Candiru infect at least 45 devices belonging to personnel at
Products
Industries
Mediaserved ads on devices associated with a wide range of government, military, critical infrastructure, media, and multilateral agencies across multiple countries.online advertisinginvasion, and facilitation for mercenary spyware attacks illustrates structural flaws with the online advertising system, which failed to detect or prevent the abuse documented in this report," they noted.