TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Citizen Lab reports that targeted online advertisements delivered Candiru mercenary spyware to devices belonging to Al Jazeera staff, describing the operation as a zero-click attack it calls AdFection. The group says Discover-Tech’s advertising platform enabled device fingerprinting and infection when an ad appeared, and that several ad companies have since cut off the firm. The full scope of infections and the extent of other activity linked to Discover-Tech remain unclear.
Devices used at international news network Al Jazeera were infected with Candiru mercenary spyware through targeted online advertisements, according to a technical investigation by the University of Toronto’s Citizen Lab. The researchers say the ads were bought by Discover-Tech, an Israeli advertising company, and delivered spyware without requiring users to click, in what they call an “AdFection” attack.
Citizen Lab says its investigation provides the first public technical confirmation of a zero-click mercenary spyware attack delivered through targeted advertising. It attributes the infection to spyware from Candiru, which has rebranded as Integrity Labs. The report does not identify the affected individuals or give a confirmed count of infected devices in the source material.
The researchers say Discover-Tech operates an advertising platform called Controlium. According to their analysis, the platform could de-anonymize and fingerprint devices, then automatically infect them when an ad was rendered. That means, in the reported attack, a user did not have to tap a link or otherwise interact with an advertisement for the exploit to run.
Citizen Lab analyzed four billion bidding records and found that Discover-Tech advertisements appeared on almost 200,000 unique websites and Android and iOS apps across dozens of countries during a four-month period. The group also says the ads covertly directed millions of devices to contact Candiru servers, likely for tracking and reconnaissance. These findings describe the researchers’ analysis; the source does not provide an independently verified count of devices infected.
How Ads Became Spyware Delivery
The report points to a security risk embedded in the real-time advertising system: ads can carry code that runs inside apps or browsers, while auctions expose device identifiers and other information to multiple parties. Citizen Lab says Discover-Tech used this infrastructure not just to select audiences, but to identify devices and deliver spyware through ad impressions.
That distinction matters for people at risk of targeted surveillance, including journalists and media organizations. A traditional warning not to click suspicious links may not help against an attack that can occur when an ad loads. The findings also raise questions about how advertising vendors vet companies that can access ad inventory and user data, and how they detect malicious code operating through legitimate-looking commercial channels.
Citizen Lab argues that the case shows weaknesses in the advertising ecosystem’s safeguards. That is the researchers’ assessment, rather than a finding from a regulator or court. The report calls for regulators to investigate whether Discover-Tech and Candiru/Integrity Labs violated applicable laws.
Android iOS device security protection
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Discover-Tech’s Advertising Network
Online advertising often relies on real-time bidding: when a website or app displays an ad slot, information about the device and the ad placement is shared with advertising intermediaries, which bid for the opportunity to show an ad. Citizen Lab notes that these requests can include identifiers, device characteristics, IP address data and location information. Ads may also contain code that runs while they are displayed.
The report says Discover-Tech presented itself as a legitimate advertising company and had appeared on vendor lists describing companies as certified or approved. It also says the company served ads through major networks, including Google, Yandex and Beeswax, and used European Union consent frameworks. Citizen Lab disclosed its findings to vendors and industry groups. Google, IAB Europe, Beeswax, Vungle (Liftoff) and Eskimi took action to disconnect Discover-Tech from their advertising systems, according to the report.
Citizen Lab also links Discover-Tech to other mercenary spyware and intelligence actors, including Intelos and Bindecy. It describes a separate actor, which it calls DARK CARTOGRAPHER, as using the company’s infrastructure to exploit mobile-carrier vulnerabilities and link advertising IDs with phone numbers. The group says it plans to publish a separate report on that activity.
““AdFection””
— Citizen Lab
As an affiliate, we earn on qualifying purchases.
Infection Scope Still Unspecified
The source material does not say how many Al Jazeera devices were infected, which people were targeted, when the infections occurred, or what information may have been accessed. It also does not detail the exploit chain or provide a public account from Al Jazeera, Discover-Tech or Candiru/Integrity Labs responding to the findings.
Citizen Lab’s analysis describes millions of devices being directed to Candiru servers, but says this was likely for tracking and reconnaissance; it does not establish that all those devices were infected. The report’s account of Discover-Tech’s wider links and the separate DARK CARTOGRAPHER operation is also based on the researchers’ findings, with further details on that actor promised in a later report. The source says some vendors did not respond to comment requests within the timeline provided.
mobile device fingerprinting protection
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Vendor and Regulatory Follow-Up
Citizen Lab says it is working with vendors to mitigate the DARK CARTOGRAPHER mass-deanonymization activity and has shared recommendations for lawmakers, defenders and advertising companies. Several named companies have already disconnected Discover-Tech’s access, according to the report. It is not clear from the source whether those steps have stopped every route through which the company’s ads or infrastructure could operate.
The researchers are calling on regulators to investigate whether Discover-Tech and Candiru/Integrity Labs breached applicable laws. Further public developments may include the separate DARK CARTOGRAPHER report, additional vendor responses, and any regulatory findings. No formal investigation or enforcement action is confirmed in the source material.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is AdFection?
Citizen Lab uses AdFection to describe the reported delivery of mercenary spyware through targeted online advertisements, where an infection can occur when an ad is displayed rather than clicked.Who does Citizen Lab say was affected?
The report says devices at Al Jazeera were infected with Candiru spyware. The source material does not identify the users or state how many devices were affected.What role did Discover-Tech play?
Citizen Lab says Discover-Tech bought the malicious ads and operated Controlium, a platform that could fingerprint devices and automatically infect them when an advertisement rendered.Did advertising companies take action?
According to Citizen Lab, Google, IAB Europe, Beeswax, Vungle (Liftoff) and Eskimi took steps to disconnect Discover-Tech from their systems after the researchers disclosed their findings.What remains unknown?
The report does not specify the number of infected devices, the identities of targeted people, the full extent of any data accessed, or whether regulators have opened investigations.Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
