TL;DR
Get business pricing on networking and server gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Citizen Lab reports that targeted online advertisements delivered Candiru mercenary spyware to devices at Al Jazeera, in what it calls AdFection and describes as a zero-click attack. The researchers say ad-tech company Discover-Tech operated infrastructure that could identify and infect devices when ads appeared; several advertising companies disconnected its access after the researchers shared their findings.
Citizen Lab says devices at Al Jazeera were infected with mercenary spyware made by Candiru through targeted online advertisements, documenting what the researchers call AdFection: a zero-click attack delivered when an ad is displayed. The report identifies Israeli advertising company Discover-Tech as the purchaser of the malicious ads and says its Controlium platform helped spyware partners identify and automatically infect devices.
The researchers describe their work as the first public technical confirmation of a zero-click mercenary spyware attack delivered through targeted advertising. In a zero-click attack, the target does not need to click a link or open an attachment: according to the report, a device could be fingerprinted and infected as the ad rendered. Citizen Lab attributes the spyware to Candiru, which has rebranded as Integrity Labs.
Citizen Lab says it analyzed four billion Discover-Tech bidding records. Across a four-month period, the company’s advertisements appeared on almost 200,000 unique websites and Android and iOS apps in dozens of countries. The researchers also found that ads covertly caused millions of devices to contact Candiru servers, which they say was likely for tracking and reconnaissance. The report does not establish that every device contacting those servers was infected.
According to Citizen Lab, Discover-Tech presented itself as a legitimate advertising company but facilitated operations for several mercenary spyware partners. The report also links it to Intelos and Bindecy. Separately, researchers identify a threat actor they call DARK CARTOGRAPHER, which they say used Discover-Tech infrastructure and mobile-carrier vulnerabilities to connect advertising IDs with phone numbers. Citizen Lab says it will publish details about that activity in a separate report.
How Ad Auctions Enabled Surveillance
The findings point to a risk beyond malicious links or apps: ordinary ad delivery may provide a route for surveillance software to reach a selected person. Real-time bidding systems share information about devices and ad impressions among multiple companies, while ads can run code inside an app or browser. Citizen Lab says Discover-Tech’s setup exploited those features to identify and target devices through ad impressions.
The scale described in the report matters because the same infrastructure reached a broad range of websites and apps, while the spyware operation targeted specific devices. That combination raises questions for publishers and users who may have little visibility into which intermediaries handle an ad or what code it carries. The report also argues that industry checks did not prevent the activity: Discover-Tech appeared on vendor lists described as certified or approved and served ads through major networks, according to the researchers.
After receiving the findings, Google, IAB Europe, Beeswax, Vungle (Liftoff), and Eskimi took steps to disconnect Discover-Tech from the digital advertising ecosystem, Citizen Lab says. The episode may prompt scrutiny of ad-vendor approval, real-time bidding data, and how platforms monitor code delivered through advertisements.
Android iOS device security protection
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Discover-Tech Inside Ad Exchanges
Online advertisements are often selected through real-time bidding. When a website or app requests an ad, information about the device, identifiers, location, IP address, and the ad slot can be shared with advertising intermediaries so they can decide whether to bid. Citizen Lab notes that these auctions happen at enormous scale and allow advertisers to target individual devices using identifiers such as mobile advertising IDs.
An ad is not always just an image or video. The report explains that advertising code and third-party tags can run in the app or browser where the ad appears. Citizen Lab says Discover-Tech used its Controlium platform to de-anonymize and fingerprint devices through this system, then trigger infection when an ad was rendered. The researchers say Discover-Tech ads were delivered through networks including Google, Yandex, and Beeswax, and that the company used European Union consent frameworks to reach users there.
Citizen Lab disclosed its findings to advertising vendors and industry organizations. It says several organizations took action to cut off Discover-Tech, while some other vendors identified in the investigation did not respond within the report’s comment deadline.
““the first public technical confirmation of a zero-click mercenary spyware attack delivered via targeted advertising””
— Citizen Lab
anti-spyware software for smartphones
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Scope and Attribution Still Developing
The report identifies devices at Al Jazeera as infected but the supplied material does not specify how many devices were affected, when each infection occurred, or which individuals were targeted. It also does not say whether the affected devices were fully remediated or whether investigators confirmed what information was taken from them.
Citizen Lab says millions of devices were covertly directed to contact Candiru servers, but describes large-scale tracking and reconnaissance as a likely purpose. That observation alone does not establish that all those devices were compromised. The report’s claims about Discover-Tech’s role, its spyware partners, and the separate DARK CARTOGRAPHER activity are findings by the researchers; the source material does not include responses from Discover-Tech, Candiru/Integrity Labs, or the other named companies.
The report also does not provide the full details of the carrier vulnerabilities or the number of people affected by the alleged advertising-ID-to-phone-number linking. Citizen Lab says a separate report on DARK CARTOGRAPHER is forthcoming.
privacy protection apps for mobile devices
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Vendor Responses and Investigations
Citizen Lab says it is working with vendors to mitigate the DARK CARTOGRAPHER mass-deanonymization activity and will publish further findings about that threat actor. It has also called on regulators to investigate whether Discover-Tech and Candiru/Integrity Labs violated applicable laws, and has issued recommendations to lawmakers, defenders, and the advertising industry.
The researchers say some advertising companies have already disconnected Discover-Tech, but the report does not establish whether every vendor involved has done so or whether access could be restored through other intermediaries. Further reporting and any regulator or company statements may clarify the scale of the infections, the firms’ responses, and the safeguards being put in place.
malware detection tools for smartphones
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What does AdFection mean?
AdFection is Citizen Lab’s name for a spyware attack delivered through targeted online advertisements. The researchers say an ad impression could trigger device fingerprinting and infection without a user clicking anything.
Who was linked to the spyware operation?
Citizen Lab says Discover-Tech purchased the malicious advertisements and that the spyware was from Candiru, which has rebranded as Integrity Labs. Those are the report’s findings; the supplied source material does not include responses from the companies.
Does the report say millions of devices were infected?
No. It says millions of devices were covertly directed to contact Candiru servers, likely for tracking or reconnaissance. The report does not say that all those devices were infected; it separately reports infections on devices at Al Jazeera.
What action did advertising companies take?
Citizen Lab says Google, IAB Europe, Beeswax, Vungle (Liftoff), and Eskimi acted to disconnect Discover-Tech from the digital advertising ecosystem after receiving the findings. The report does not say that every vendor identified in the investigation took action.
What remains unknown?
The available report material does not specify the number of Al Jazeera devices infected, the identities of targets, or what data may have been accessed. Details about the separate DARK CARTOGRAPHER activity are expected in a forthcoming Citizen Lab report.
Source: hn
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
