First Mercenary Spyware Delivered Via Targeted Ads Uncovered by CitizenLab

CitizenLab confirmed the first publicly confirmed instance of mercenary spyware delivered via online targeted ads, dubbing it "AdFection."

It's well-known that online advertisers track you around in order to deliver targeted ads based on your activity.

It's also known that ads are often used by bad actors as a way to deliver malware or scams on popular websites. Online ads can run code as soon as you load a web page without any user interaction.

Browsers run untrusted code all the time and they have millions of lines of code for handling different types of media, protocols, etc, so they're excellent entry points for malware to infect the rest of your system.

Using the ad-targeting capabilities of online advertisers to infect specific individuals with mercenary spyware seems like an inevitable outcome, but until now it wasn't confirmed exactly how these companies abuse ads to target people.

CitizenLab uncovered that Discover-Tech, an Israeli advertising company, is acting as a front for "large-scale ad espionage abuse, including the automatic delivery of mercenary spyware when ads are displayed to a target and the mass profiling and deanonymization of users."

The company serves as a bridge connecting advertisers with the mercenary spyware ecosystem. It's Controlium platform allows for the precise profiling and fingerprinting of users in order to deliver targeted zero-day exploits.

The attacks are zero-click, requiring no interaction from the user in order to become infected.

Discover-Tech got certified and approved by Google and IAB Europe, enabling them to appear legitimate and push their malware on some of the biggest ad networks in the world.

After the CitizenLabs investigation, Google terminated Discover-Tech's access to its ad platform and it was removed from IAB Europe's GVL approved vendors list.

AdFection was used to target the new organization Al Jazeera, with at least 45 devices infected.

Controlium, a platform provided to their customers, allows pushing malicious content to individual users based on their identifiers.

CitizenLab also identified a mass-deanonymization attack they call DARK CARTOGRAPHER that exploited vulnerabilities in carriers to link advertising IDs with phone numbers, which are in most cases tied to your real-life identity.

Browser vendors have made strides in security in recent years, but it'll always be a cat-and-mouse game with attackers. Installing a good content blocker can be a good way to protect yourself against threats like this.