Last week, the forensic digital security NGO Citizen Lab documented a cyberattack it named Adfection. It was found on 45 Al Jazeera journalists’ computers. It used zero-click spyware created by Israeli spyware developer Candiru, which implanted malware in ads displayed on a web page. It infected the computer and gave access to nearly every user activity, including email, texts, video and audio, browser activity, etc. The targeted user did not have to click on a link or download a file.
The campaign required an online company to buy the ads which compromised the device. It was an Israeli company called Discover-Tech. Its platform, Controlium, strips the anonymity of targeted individuals even if they have encrypted or masked their digital footprint. The ads also covertly directed millions of devices to Candiru’s servers, where their content was harvested for large-scale tracking and reconnaissance.
Citizen Lab noted that Discover Tech purports to be a legitimate ad company. But in reality, it is a front for large-scale Israeli espionage
This campaign required a second player, the spyware firm, Candiru. Ironically, it was named for an Amazonian fish which feeds on the blood of host fishes. Considering its business model, the name seems apt. Candiru wrote the code which was implanted with the ads. They then placed the ads on specific websites visited by targeted individuals.
Its partner, Discover-Tech, not only placed the ads but also amassed geo-data that let it identify and track targets, a process known as microtargeting. They track users’ physical location and follow their movements. The spyware also tracks devices in cellular, Wi-Fi, or VPN modes.
Discover-Tech placed 4 billion ad bids. The ads were served on 200,000 different Android and Apple apps and various websites. In particular, they targeted defence, foreign affairs, internal security, military and intelligence bodies. These agencies included NATO, the Pentagon, the International Criminal Court, Israeli government ministries (foreign, defence, police), and the European Parliament. In all, users in 23 countries were attacked.
Candiru, which designed Adfection, has led a mysterious existence since its founding in 2014. It has changed its name repeatedly to skirt sanctions and accountability. It is currently named Integrity Labs. Another bit of irony considering the “integrity” of malware design.
Its website claims it is based in Hong Kong with offices in various Asian cities. It doesn’t mention Herzliya, where it was founded and where its CEO is based.
In fact, Israeli companies seeking to shield themselves from exposure and avoid potential interference from Israeli regulations employ a well-known subterfuge by moving operations abroad. Similarly, Integrity Labs’ peripatetic existence “created a corporate buffer to distance its operations from US sanctions [against Candiru] while continuing to deploy surveillance tools.”
Who engineered the spyware campaign?
Citizen Lab declined to identify which country or government entity managed this overall project. It seems highly likely it was Israel, considering a majority of those targeted were either in Europe or the Middle East.
The most likely Israeli source for such a campaign is the IDF’s SIGINT branch, Unit 8200, whose mission is to intercept communications using precisely the tools developed by Candiru/Integrity Labs.
Israel also has explicit interest in many of the entities targeted, including the Pentagon, ICC and Al Jazeera. Though Adfection appeared on Pentagon computers, Citizen Lab did not indicate whether US intelligence assets were attacked as well.
Israel is a world leader in developing surveillance, spyware, and cyber-attack products. The IDF field tests many of them in Palestine, which is among the most surveilled places on earth. There are tens of thousands of CCTV cameras, facial recognition technology, AI, drones, telecommunication intercepts, and a massive database compiled on every individual Palestinian.
Israel's primary signals intelligence corps, Unit 8200, has created multiple AI-based tools to exert control over a restive population. Among them are Where’s Daddy, Ha’bsorah (“Good News”), and Fire Factory. The AI program, Lavender, assigns a 1 to 100 score for all 2.5 million Gazans to determine if they should be killed. In other words, artificial intelligence makes life-and-death decisions leading to the murder of thousands of Palestinians.
Many Israeli companies like NSO Group, Candiru, Intellexa, Cellebrite, Circles and Paragon were founded by Unit 8200 veterans. They are leaders in the development of spyware used by police and intelligence agencies throughout the world to surveil—and even murder--human rights activists, journalists (among them, Jamal Khashoggi), and lawyers. They are products of the Israeli surveillance state, exported worldwide along with the oppressive values they represent.
Israel has created a Brave New World of digital surveillance and sold it to some of the most dangerous individuals and repressive regimes on earth. It is a World of chaos and cruelty, like Hobbes' war of all against all.
International bodies like the United Nations appear unable or unwilling to impose any regulation on these nefarious tools, which pose a grave threat to democracy, justice and human rights.
Richard Silverstein writes the Tikun Olam blog and is a freelance journalist specialising in exposing secrets of the Israeli national security state. He campaigns against opacity and the negative impact of Israeli military censorship.
Follow Richard on X: @richards1052
Have questions or comments? Email us at: editorial-english@newarab.com
Opinions expressed in this article remain those of the author and do not necessarily represent those of The New Arab, its editorial board or staff.
