Advertising kills: Researchers may have uncovered the first case of a “zero-click” spyware attack. The malicious cyber operation is linked to an Israeli advertising organization that allegedly misused online ads to target a well-known international media company based in Qatar.
A new investigation from Citizen Lab has uncovered a large-scale sting operation aimed at installing spyware via online advertisements. The technique, dubbed “AdFection” by the University of Toronto research unit, was allegedly used by unknown Israeli actors to infect computers at the Al Jazeera news network.
Citizen Lab said their research provides the first public confirmation that zero-click spyware attacks are possible and are already being exploited for malicious operations. More specifically, the AdFection technique was used by Discover-Tech, an Israeli advertising company, to facilitate the distribution of spyware or carry out other malicious activities.
Discover-Tech provides a platform called Controlium that its advertising partners can allegedly abuse to de-anonymize and identify their targets. Controlium also serves as a “gateway” through which third parties can potentially infect computers. No specific user interaction is required: the platform can allegedly download and run a malicious tool like Candiru, a commercial spyware product that Citizen Lab found on Al Jazeera’s computers.
According to the researchers, Discover-Tech’s advertisements appeared on approximately 200,000 unique websites and mobile apps in multiple countries. These ads are designed to direct millions of users to servers connected to Candiru. This large-scale tracking and reconnaissance operation was then used to identify and infect selected targets.
Discover-Tech is one of Google’s “certified” advertising providers and is also described as a GDPR-compliant company operating in European countries. Additionally, Citizen Lab identified a second threat actor known as “Dark Cartographer” that was working with the Israeli advertising platform. This group was primarily interested in exploiting vulnerabilities in cell phone providers to deanonymize Internet users on a large scale.
According to Citizen Lab researcher Wolfie Christl, major advertisers and companies appeared to have no interest in detecting or preventing abuse by malicious Israeli actors. The entire online advertising ecosystem should now be viewed as a security threat to governments, private organizations and ordinary users alike, Christl said.
The Canadian report documents a malicious technique that researchers have long viewed as a potential threat to cybersecurity. The newly documented AdFection method can be used to identify and compromise specific targets with considerable precision. Authorities around the world should now investigate the incident and consider appropriate legal action against those responsible.
