Zero-click spyware infecting devices through online ads, researchers say

Powerful zero-click spyware is being delivered to individuals worldwide through targeted ads, new research shows — an alarming development in the spread of surveillance technology.

Parallel investigations led by the digital forensic research institute the Citizen Lab and the ad tech-focused cybersecurity company Confiant documented how the Israel-based purported advertising firm Discover-Tech used digital ads to infect devices used by at least 45  journalists at Al Jazeera. 

The malicious infrastructure also served ads onto the internal networks of dozens of government agencies and international organizations, but the report did not say how many officials’ devices were compromised. Researchers found evidence that Discover-Tech ads were displayed on devices in “national-security-sensitive networks around the world,” including  NATO, Citizen Lab said. 

Confiant separately analyzed targeting data and found evidence suggesting that the malicious ads were rendered on networks in the U.S. Department of Defense, Estonia’s Information System Authority (RIA), the International Atomic Energy Agency (IAEA) and the International Criminal Court.

Discover-Tech allegedly collaborated with the Israeli spyware company Candiru, whose product has long been used to snoop on members of civil society and was blacklisted by the U.S. Commerce Department in 2021. Candiru allegedly hired Discover-Tech to send the ads, the report said, and the mercenary spyware company used it to spy on Al Jazeera journalists and others.

The ads “covertly directed millions of devices to contact Candiru’s servers, likely for large-scale tracking and reconnaissance,” the report said.

The digital advertising firm, which Google and other major platforms have blocked in the wake of the research, has also worked with other Israeli spyware companies, allowing them access to ad platforms hosted by Google and Russia’s Yandex, Citizen Lab said. Discover-Tech allegedly served millions of ads that were used to monitor targets and break into their devices.

Discover-Tech’s platform, known as Controlium, allows its spyware clients to “deanonymize, fingerprint and automatically infect devices the moment an advertisement is rendered — a form of zero-click attack, where their devices can be automatically infected when an ad is displayed to them,” the report said. Deanonymization matches encrypted or pseudonymous data with public data, leading individuals to be unmasked.

Candiru contracts with Discover-Tech to use its platform to deliver malicious ads, according to the report.

Discover-Tech automatically executes malicious JavaScript code when an identified target visits a page with one of its ads. It avoids “directly sharing malicious code, or even pointers to malicious code, with the companies who serve and display the ads,” the researchers said.

The Citizen Lab studied four billion Discover-Tech ad placement records and found that over just four months the corrupted ads were allegedly displayed on Android/iOS apps and nearly 200,000 unique websites.

The Controlium software allows spyware firms to record calls, turn on microphones and siphon off messages and emails, the Citizen Lab said. In addition to government officials, Controlium has been used to infect devices belonging to reporters, dissidents, and embassy staffers.

Discover-Tech serves as a “bridge between ad vendors and the mercenary spyware ecosystem,” the Citizen Lab report said. “In fact, it appears that serving as this bridge is Discover-Tech’s primary purpose.”

By using Discover-Tech, spyware operators like Candiru could track and infect devices without facing traditional barriers like restrictions barring anyone other than government officials from buying the software and the need for using social engineering tactics.

While there has been previous research suggesting that ad tech can potentially be used to facilitate spying, the new findings are far more definitive and detailed than what was previously known and represent the first time researchers have collected technical evidence backing up suspicions.

Candiru and other spyware firms are not the only users of Discover-Tech, the report said. A different threat actor the researchers have named Dark Cartographer also uses the company’s software to take advantage of vulnerabilities in mobile carriers to tie device advertising IDs to phone numbers, a tactic the report said facilitated the mass-deanonymization of people online.

The lack of regulation in the digital advertising ecosystem needs to change, the Citizen Lab said.

“Ad vendors must significantly level up their cybersecurity and threat detection capacity to effectively cut off malicious advertisers across the supply chain,” the report said. “They must rigorously and regularly vet, screen, and audit their business partners and hold them accountable for their own supply chains.”