Candiru spyware has infected devices at international news network Al Jazeera in zero-click attacks, via targeted advertisements, Canadian internet watchdog group Citizen Lab reports.
As part of the operation, dubbed AdFection, ads purchased by Israeli company Discover-Tech were used to de-anonymize, fingerprint, and infect users, and also allow threat actors to track millions of devices.
As part of the online advertising ecosystem, companies bid at billions of daily Real-Time Bidding (RTB) auctions hosted on ad exchanges for a chance to serve an ad to a user.
Ad exchanges collect extensive device and user data that enables tracking, and ads may contain code that runs in the user’s application or browser, typically for tracking users, impressions, and clicks.
However, ads may also contain malicious code potentially leading to malware infections and, courtesy of the various identifiers used within the ecosystem, could be used to target specific individuals with spyware, Citizen Lab says.
Discover-Tech, a seemingly legitimate advertising company, is likely the front for a large campaign involving spyware infection and espionage, serving as a bridge between ad vendors and mercenary spyware vendors.
Its Controlium platform enables the de-anonymization of millions of users, device fingerprinting, and zero-click hacking when an ad is displayed on the victim’s device.
While the company appears to work with multiple mercenary partners, Citizen Lab has confirmed its use to profile users and infect them on behalf of Candiru, an Israel-based spyware vendor.