Citizen Lab researchers reported an operation called AdFection that they said could deliver spyware to phones and computers through online advertising without requiring a click, according to Engadget. The researchers linked the technology to Discover-Tech, an Israeli company that presents itself as an advertising business.
Google said it blocked Discover-Tech from its advertising platforms following a joint investigation with Citizen Lab and Confiant. In a statement quoted by Engadget, Google said Discover-Tech had systematically violated its policies.
Engadget reported that the researchers identified journalists and Al Jazeera staff among the targets, along with officials or employees at organizations including NATO, the European Commission, NVIDIA and Arm.
How researchers described the advertising attacks
According to Citizen Lab’s findings as reported by Engadget, the delivery method could expose a device to spyware simply by displaying an advertisement. The researchers characterized their findings as the first confirmation of government-backed, zero-click spyware attacks delivered through online ads.
The reported method involved real-time bidding, an automated auction process that lets advertisers compete to display ads to particular internet users. Citizen Lab said Discover-Tech used that system to profile users and identify them before targeting them with spyware concealed in apparently ordinary advertisements.
Citizen Lab senior researcher Bill Marczak told the Financial Times that Discover-Tech had used the advertising ecosystem for years to turn websites and popular apps into a spyware delivery platform. Citizen Lab’s report described the company as a connection between advertising vendors and the commercial spyware industry.
Reported advertising reach and industry connections
Engadget cited a reported total of 442 million ads displayed across more than 120,000 websites, including the BBC and The New York Times. Mobile apps named in the coverage included Duolingo, Badoo and Grindr. Those advertising figures do not establish how many devices were successfully infected with spyware.
According to Engadget’s account, the researchers said advertisements also reached devices used by militaries, governments, critical infrastructure organizations and national cyber agencies.
Citizen Lab also reported finding login records on Discover-Tech’s website associated with employees of spyware maker Candiru, Engadget wrote.
Marczak advised people who might be targeted because of their identity or work to disable ad tracking on their devices or block advertising. Engadget reported that Discover-Tech and other parties implicated in the findings had not commented at the time of its coverage.