TL;DR
Get business pricing on networking and server gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Citizen Lab reports that targeted online advertisements delivered Candiru mercenary spyware to devices at Al Jazeera, in what it calls the first publicly documented technical confirmation of a zero-click spyware attack through ads. The report says Discover-Tech facilitated the operation through its Controlium platform; several advertising companies and industry groups cut off its access after receiving the findings.
Devices at international news network Al Jazeera were infected with Candiru mercenary spyware through targeted online advertisements, according to a technical report from the University of Toronto’s Citizen Lab. The researchers call the method AdFection and say their findings are the first public technical confirmation of mercenary spyware delivered through advertising in a zero-click attack, meaning the targeted user did not need to tap an ad.
Citizen Lab attributes the ad purchases to Discover-Tech, an Israeli company that presents itself as an advertising business. The report says Discover-Tech operates a platform called Controlium, which its researchers found could help mercenary spyware partners identify and fingerprint devices and trigger infection when an advertisement is rendered. Candiru, which has rebranded as Integrity Labs, is identified as the spyware provider in the Al Jazeera cases.
Researchers examined four billion bidding records and found that, over a four-month period, Discover-Tech ads appeared on almost 200,000 unique websites and Android and iOS apps across dozens of countries. Citizen Lab also says the company’s ads covertly directed millions of devices to contact Candiru servers, likely for tracking and reconnaissance. The report describes these as findings from its analysis; the precise scope and consequences of that activity are not established in the supplied material.
After Citizen Lab disclosed its findings, Google, IAB Europe, Beeswax, Vungle (Liftoff) and Eskimi took action to disconnect Discover-Tech from their advertising systems, according to the report. The researchers say other ad vendors they identified did not respond within the timeline they gave. Citizen Lab also links Discover-Tech’s infrastructure to spyware partners Intelos and Bindecy and to a separate operation it calls DARK CARTOGRAPHER; it says a further report on that threat actor is forthcoming.
How Ad Auctions Can Enable Espionage
The report points to a risk in the machinery behind ordinary online advertising: ad auctions distribute detailed information about devices and allow code to run inside apps and websites. Citizen Lab says those features can be repurposed to select specific targets and deliver malicious code without a click, turning routine ad rendering into a possible route for surveillance.
The consequences reach beyond the people directly targeted. The researchers say Discover-Tech ads appeared across a very large range of sites and apps, and that millions of devices were directed to Candiru servers. That does not mean all those devices were infected, but it shows how an advertising supply chain can potentially expose users at scale. The findings also matter to publishers and ad vendors, whose systems may carry an attack even when the site or app itself is not the operator.
Citizen Lab argues that the case exposes weaknesses in industry screening and oversight. It says Discover-Tech had appeared on vendor “certified” or “approved” lists and had served ads through major networks. The company’s presence in those channels raises questions about how advertising intermediaries assess customers and code, and how quickly they can respond when evidence of abuse emerges.
As an affiliate, we earn on qualifying purchases.
The Advertising Systems Behind AdFection
Online ads are commonly sold through real-time bidding. When an app or website requests an ad, information about the device and the available ad slot is shared with advertising intermediaries, which bid for the opportunity to show an advertisement. Citizen Lab notes that bid information can include identifiers, device characteristics, IP address and location data. The auction happens rapidly and may involve multiple companies.
An ad can also contain or load code, not just an image or video. That code can run inside a browser or app while the ad is displayed. The report says Discover-Tech used this combination of targeting data and executable ad content to facilitate the attacks. Citizen Lab also says the company leveraged European Union consent frameworks to target users there, though the supplied material does not detail the specific consent flows or legal findings.
The researchers describe a separate activity, DARK CARTOGRAPHER, involving exploitation of vulnerabilities across mobile carriers to connect advertising IDs with phone numbers and deanonymize internet users. Citizen Lab says it is working with vendors to mitigate that activity and plans a separate report. It should not be conflated with the confirmed spyware infection findings involving Al Jazeera devices.
““the first public technical confirmation of a zero-click mercenary spyware attack delivered via targeted advertising””
— Citizen Lab
As an affiliate, we earn on qualifying purchases.
Scope, Responsibility and Legal Findings
The supplied report summary does not identify how many Al Jazeera devices were infected, when the infections occurred, which individuals were targeted, or what information may have been accessed. It also does not provide responses from Discover-Tech, Candiru/Integrity Labs or all the advertising companies named in the investigation. Those gaps limit what can be said about the full impact and the companies’ accounts of the findings.
Citizen Lab says the ad activity likely supported tracking and reconnaissance, but the material does not establish that every device directed to Candiru servers was infected or monitored. The researchers have asked regulators to investigate possible legal violations; no legal finding is reported here. The separate DARK CARTOGRAPHER investigation is also incomplete in the supplied material, and the researchers say its details will follow.
As an affiliate, we earn on qualifying purchases.
Vendor Response and Further Reporting
Citizen Lab says it disclosed the findings to advertising vendors and industry organizations and is working with them on mitigation. It reports that five named organizations disconnected Discover-Tech, while others did not respond within the requested period. The report does not specify whether further companies have since acted or whether Discover-Tech has regained access through other channels.
The researchers say they are working with vendors to address DARK CARTOGRAPHER and plan to publish a separate report on that operation. They also called on regulators to examine whether Discover-Tech and Candiru/Integrity Labs broke applicable laws. Further reporting, company responses and any regulatory inquiries would help establish the extent of the activity and its consequences.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is AdFection?
AdFection is Citizen Lab’s name for the reported use of targeted online ads to deliver mercenary spyware. In the cases described, an advertisement could trigger the attack when displayed, without the user clicking it.
Who does Citizen Lab say was involved?
The report identifies Discover-Tech as the company that purchased the ads and says its Controlium platform facilitated the operation. Citizen Lab identifies Candiru, rebranded as Integrity Labs, as the spyware provider in the Al Jazeera cases.
Does the report say millions of devices were infected?
No. Citizen Lab says ads covertly directed millions of devices to contact Candiru servers, likely for tracking and reconnaissance. That figure does not establish that all those devices were infected; the supplied material does not give a total number of infected devices.
What action did advertising companies take?
Citizen Lab says Google, IAB Europe, Beeswax, Vungle (Liftoff) and Eskimi disconnected Discover-Tech’s access after receiving the findings. The report says other vendors did not respond within the stated timeline.
Has a regulator found that the companies broke the law?
The supplied report material describes a call for regulators to investigate possible violations. It does not report a regulatory ruling or a court finding.
Source: hn
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
