AdFection Delivered Spyware Through Online Ads Without a Click | Межа

Researchers traced a spyware campaign to routine-looking online ads that needed no click. The findings raise questions how advertising systems can expose targeted users.

The new AdFection spyware can infect phones and computers through online ads – without users clicking on or interacting with them. Researchers at Citizen Lab describe it as the first confirmed case of government-backed spyware being delivered through ads using a “zero-interaction” approach.

As reported by engadget.com .

According to the researchers, the technology was developed by the Israeli company Discover-Tech. It used automated real-time ad auctions to target specific users, identify them, and serve them ads containing malicious code. The ads could look perfectly ordinary.

Discover-Tech presented itself as a legitimate advertising company, but Citizen Lab’s assessment is that it effectively became an intermediary between ad platforms and the commercial spyware industry.

Those targeted included journalists and employees of Al Jazeera, as well as officials and staff at NATO, the European Commission, NVIDIA, and Arm. Ads appeared on devices used by people working in the military, government, critical infrastructure, and national cybersecurity agencies.

Ad platforms and the scale of the campaign

Google was one of the major ad platforms used to distribute the spyware. Following a joint investigation with Citizen Lab and Confiant, Google blocked Discover-Tech from its ad platforms for repeatedly violating its policies and removed it from its global partner list.

Researchers estimate that Discover-Tech served 442 million ads across more than 120,000 websites, including the BBC and The New York Times, as well as in apps such as Duolingo, Badoo, and Grindr. The vast reach of online advertising can make it a channel for secretly distributing malicious software.

On Discover-Tech’s website, researchers also found login logs containing data associated with employees of Candiru, a spyware developer. According to Citizen Lab researcher Bill Marczak, these findings may represent only a small part of the company’s overall activity.

Discover-Tech and the other parties involved did not . The investigation shows how advertising infrastructure designed to target specific audiences can become a channel for the covert delivery of spyware.

More interesting materials:

Citizen Lab confirmed that Pegasus spyware infected Stelios Kouloglou’s iPhone in 2022 and again in 2023 via a zero-click exploit, marking the first public case of an EU lawmaker targeted during an investigation.