Targeted ads delivered zero-click exploits to install mercenary spyware

Citizen Lab, a research lab that investigates digital surveillance, published a report on Thursday describing a campaign called AdFection. In it, the Israeli advertising company Discover-Tech served targeted ads that were used to install mercenary spyware on users' devices. Mercenary spyware is surveillance software built by commercial firms and sold to customers who want to covertly monitor chosen people. Here it was developed and distributed by Candiru, which has rebranded as Integrity Labs.

How the attacks worked

Candiru's customers specified profiles of interest. People matching them received ads carrying JavaScript or other code that connected to Candiru's control servers. The servers responded with an exploit that ran a zero-click payload when the ad appeared on the device, so the victim had to do nothing. The report does not describe the vulnerabilities used or the final malware. They were likely zero-days that have been fixed since Citizen Lab found the campaign.

Trusted status and fallout

Google and the advertising industry association IAB Europe had listed Discover-Tech as a "certified" or "verified" vendor. The firm also used European General Data Protection Regulation (GDPR) consent frameworks to target users in the European Union. It served ads through networks including Google, Yandex and Beeswax. Google and IAB Europe have removed it from their vendor registries, and Google ended its access to its ad exchange platforms. Beeswax removed it from its buying platform, Vungle (Liftoff) paused its access during a review, and Eskimi blocked its accounts and domains.

The report says Discover-Tech ad impressions appeared on government and national-security-linked networks worldwide, including NATO, United Nations networks, European lawmaking bodies, Australian critical infrastructure providers, and armed forces and government agencies in Norway and Sweden. Citizen Lab said the case illustrates structural flaws in the online advertising system, which failed to detect or prevent the abuse. Discover-Tech and Candiru did not answer messages.

Citizen Lab urged advertisers and government officials to take concrete preventive action. For users, it suggests ad blockers, resetting the mobile advertising ID in iOS and Android settings, ad blocking on home or office networks, and installing updates promptly.