Israeli ad firm ran spyware campaign that hit 45 Al Jazeera devices, researchers say

At least 45 devices at Al Jazeera were targeted in zero-click attacks that Citizen Lab linked with high confidence to Candiru spyware delivered through advertisements run by Discover-Tech, an Israeli advertising firm.

The finding is part of technical evidence released on Thursday by Citizen Lab and the New York advertising security firm Confiant, which described a campaign they call AdFection. The researchers say it shows sophisticated mercenary spyware being distributed through targeted online advertising.

Zero-click spyware needs no tap, download or other action from the person using the phone. In this case, Citizen Lab said, some advertisements delivered Candiru spyware simply by loading in a browser.

Discover-Tech, which was registered in 2020, presented itself as an advertising business while acting as a conduit for several mercenary spyware partners, including Candiru, the Israeli spyware company blacklisted by the US government.

Its advertisements appeared across more than 120,000 websites and 75,000 apps through various partnerships. Between March and June, the ads loaded silently on those sites and apps, reaching millions of devices globally.

The company was sending out at least 10 million advertisements a day around the world, according to the researchers. People who visited a site or used an app carrying its malicious ads could be identified, tracked and targeted without doing anything themselves.

Discover-Tech used ads to track targets and help compromise their devices, Citizen Lab said. It called the system Controlium, a platform that allowed surveillance partners to de-anonymize and fingerprint devices, then automatically infect them as an advertisement was rendered.

The arrangement gave Candiru access to advertising platforms. Discover-Tech also provided access to other Israeli surveillance firms through platforms run by Google, Comcast, Russia’s Yandex and others.

Citizen Lab said Discover-Tech’s ads covertly caused millions of devices to contact Candiru servers. Candiru’s spyware has demonstrated the ability to remotely take over a device, steal its data and use its microphone and camera.

The ads were also found on sensitive networks, including those of the US Department of Defense, NATO, the International Atomic Energy Agency and cybersecurity agencies around the world.

The full number of devices infected globally has yet to be established. The research identifies advertisements on those sensitive networks, while leaving open whether users there were infected.

Google removed Discover-Tech from its vendor registries and cut off its access to Google advertising platforms after the research was published. IAB Europe also removed the company from its global vendor list.

For Wolfie Cristl, a senior Citizen Lab researcher involved in the investigation, and Confiant, the discovery puts a new and unusually quiet delivery system into view: the ordinary online advertisement, loaded in the background while a user reads a page or opens an app.