Citizen Lab Exposes Ad Network Used to Deliver Zero-Click Spyware Attacks

Discover-Tech, an Israeli advertising company, was listed as a “certified” or “verified” vendor by major industry organizations, including Google and the advertising industry group IAB Europe. The company also used the European Union’s General Data Protection Regulation (GDPR) consent framework to target users in the region.

Discover-Tech served advertisements through major ad networks, including Google, Yandex, and Beeswax. After Citizen Lab reported the company’s alleged activities, Google and IAB Europe removed Discover-Tech from their vendor registries. Google also suspended the company’s access to its ad exchange platform.

Beeswax removed Discover-Tech from its ad-buying platform. Vungle, now part of Liftoff, suspended the company’s access during a review, while Eskimi blocked Discover-Tech’s account and domain.

Discover-Tech Ads Appeared on Government and Military Networks

Thursday’s report said Discover-Tech’s ad impressions appeared on government and national security-related networks around the world. These reportedly included NATO and United Nations networks, European legislative bodies, critical infrastructure providers in Australia, and military and government agencies in Norway and Sweden.

“Discover Tech’s large-scale fraud, privacy violations, and mercenary facilitation of spyware attacks demonstrate structural flaws in online advertising systems that failed to detect or prevent the fraudulent activities described in this report,” Citizen Lab said in a statement.

AdFection Campaign Linked to Candiru Spyware

Citizen Lab said the mercenary malware installed through the campaign, called AdFection, was developed and distributed by Candiru, a company that has since been renamed Integrity Labs.

Under an arrangement with Discover-Tech, targets matching specific profiles of interest to Candiru’s customers were shown advertisements containing JavaScript or other code. That code connected to Candiru’s control servers, which then delivered exploits capable of installing zero-click payloads when the ads were displayed on personal devices.

Researchers Did Not Identify the Exploited Vulnerability

The study did not describe the vulnerabilities used in the zero-click attack or identify the final malware installed on targeted devices. Citizen Lab said the vulnerability was likely a zero-day that was fixed after the institute discovered the campaign.

Citizen Lab did not immediately respond to questions. Discover-Tech and Candiru also did not respond to messages seeking comment.

How Users Can Reduce Spyware Risk

Citizen Lab called on advertisers and government officials to take concrete steps to proactively stop campaigns like AdFection. The institute also said users can reduce their risk of infection by installing an ad blocker, resetting their mobile advertising ID in iOS or Android settings, and using ad-blocking software on home and office networks.

Users should also install operating system and app updates promptly, since timely security updates can help protect devices against known vulnerabilities.