It requires 'no interaction' from victims to infect devices.
Vaselena/Getty Images
A new type of spyware dubbed "AdFection" is infecting phones and computers via global online advertising networks, according to a new report from Citizen Lab. The attack is unique in that it can infect devices just by showing an ad, with no need for the victim to click on a link or file. The researchers said that AdFection is the first confirmation of zero-click government-backed spyware attacks being delivered through online ads.
The ad-infiltrating technology was reportedly developed by Israeli company called Discover-Tech. Researchers said it has been used to target journalists and staff at the Al Jazeera news network, along with officials and employees at organizations including NATO, the European Commission, NVIDIA and Arm.
"Discover-Tech has leveraged the advertising ecosystem for years to turn trusted websites and popular apps into a zero-click spyware delivery platform," Citizen Lab senior researcher Bill Marczak told The Financial Times. Discover-Tech presents itself as a legitimate advertising firm but instead serves as a "bridge between ad vendors and the mercenary spyware ecosystem," Citizen Lab's report states
Google was among the major ad platforms targeted by the spyware, but it has now suspended Discover-Tech from its global vendor list. "Following a joint investigation with Citizen Lab and Confiant, Google blocked Discover-Tech from our ad platforms for systematically violating our policies," the company said in a statement.
Targeted online advertising is a highly desirable medium to spread malware because it's prevalent on the web globally. It works though an automated real-time bidding auction system that lets advertisers compete to show ads to specific internet users. Discover-Tech's software used the system instead to profile and de-anonymize such users before targeting them with spyware, the report states. Victims were then sent malicious malware code buried in innocent-looking ads.
Discover-Tech reportedly displayed 442 million ads on more than 120,000 websites, including the BBC and New York Times, along with mobile apps like Duolingo, Badoo and Grindr. The ads were shown on devices used by militaries, governments, critical infrastructure and national cyber agencies. Citizen Lab researchers found login records on Discover-Tech's site, including details belonging to employees of the spyware maker Candiru.
The discovery is "surely just the tip of the iceberg," Marczak said in the blog post. "If you might be targeted based on who you are or what you do, it's time to disable ad tracking on your devices or even block ads altogether." Discover-Tech and other players in the scheme have yet to comment.