The University of Toronto’s Citizen Lab and ad-security firm Confiant have documented what they call the first confirmed “zero-click” mercenary spyware attack delivered through targeted advertising, BetaKit reports. The researchers named it AdFection.
How it worked:
- Israeli ad company Discover-Tech bought ads that ran on nearly 200,000 websites and apps in dozens of countries, from dating apps to news sites including CBC.
- Each time an ad loaded, it sent the viewer’s IP address to Discover-Tech.
- If that person was a target, malicious code ran in the browser or app and installed spyware from Israeli vendor Candiru. No click was needed.
Dozens of devices at Al Jazeera were compromised. After Citizen Lab and Confiant notified them, Google and Beeswax cut Discover-Tech off from their ad marketplaces. A second group, which the researchers call “Dark Cartographer,” is using the same infrastructure against mobile carriers. That’s the subject of a coming report.
The researchers want cybersecurity agencies and regulators in the U.S., Canada and Europe to detect and block these attacks.
Why it matters: Most spyware advice assumes you have to click something. This attack only needed a normal ad on a normal site, including a Canadian one. For journalists, activists and anyone at risk of targeting, ad blockers and privacy-focused browsers are now basic security, not just a preference.
