Researchers say an ad platform could identify targets and install spyware through online ads, no click needed

A zero-click spyware attack, dubbed AdFection, has been uncovered by researchers at the University of Toronto's Citizen Lab. The malicious operation, allegedly orchestrated by unidentified Israeli actors, targeted a prominent international media company based in Qatar, specifically Al Jazeera's news network. AdFection is attributed to an Israeli advertising organization, Discover-Tech, which exploited the advertising platform Controlium to install spyware on computers without requiring any user interaction.

Controlium enables third-party abuse, potentially facilitating the spread of malicious tools like Candiru, a commercial spyware product discovered in Al Jazeera's systems. Discover-Tech, listed among Google's certified advertising vendors and considered GDPR-compliant, targeted approximately 200,000 unique websites and mobile apps across multiple countries.

The ad-driven tracking and reconnaissance operation was used to identify and infect selected targets. Another threat actor, Dark Cartographer, collaborated with Discover-Tech, focusing on exploiting mobile carrier security vulnerabilities for mass de-anonymization. The Canadian researchers warn that major advertising vendors and corporations displayed little interest in detecting or preventing abuse by malicious Israeli actors, making the entire online advertising ecosystem a security threat to governments, organizations, and users.

Authorities worldwide are urged to investigate the operation and consider legal action against those responsible.