Online ads weaponised to deliver ‘zero-click’ spyware, researchers say

Live updates

1. 1h ago

   Israeli firm weaponized targeted ads to deliver zero-click spyware

   Researchers at The Citizen Lab have provided the first public confirmation of mercenary spyware delivered through targeted online advertisements. An Israeli company called Discover-Tech used its Controlium software to mass-profile internet users and covertly hack targets. This technique, dubbed AdFection, allowed the delivery of zero-click exploits that install malware without user interaction. The investigation revealed that Discover-Tech helped the surveillance vendor Candiru infect devices belonging to Al Jazeera staff. The system transforms standard ad-tech pipelines into a delivery mechanism for sophisticated mercenary surveillance tools.

   Why it matters

   Zero-click exploits are particularly dangerous because they require no action from the victim to compromise a device. The use of legitimate advertising networks allows attackers to bypass traditional security perimeters. This case demonstrates how commercial ad-tech can be repurposed for state-level espionage.

   What is confirmed

   • Discover-Tech used its Controlium software to mass-profile users and covertly hack targets.
   • The AdFection technique delivered Candiru spyware to devices at Al Jazeera.
   • The operation utilized targeted online ads to deliver zero-click exploits.
   • Researchers at the University of Toronto and The Citizen Lab uncovered the operation.

   Still unconfirmed

   • Governments are using online ads to secretly install spyware on targets.

   What to watch next

   • Technical analysis of the specific vulnerabilities exploited by the AdFection technique.
   • Response or legal action from Discover-Tech regarding the Controlium software allegations.
   • Identification of other organizations targeted by Candiru via this ad-tech pipeline.
   Sources used for this update (14)

   1. www.theguardian.com — AI godfather Geoffrey Hinton: ‘We’re creating alien beings. I’m willing to be selfish and choose humans’ | Donald Trump
   2. WIRED — ‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads
   3. The Citizen Lab — Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware
   4. Reuters — Israeli firm used online ads to run vast spy operation, researchers say
   5. Financial Times — New ‘zero-click’ spyware hacked phones using targeted ads
   6. The Guardian — Online ads weaponised to deliver ‘zero-click’ spyware, researchers say
   7. Al Jazeera — Israeli ad-tech firm helped place spyware on Al Jazeera devices
   8. Ars Technica — Targeted ads delivered 0-click exploits to install mercenary malware
   9. citizenlab.ca — Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware - The Citizen Lab
   10. m.rediff.com — Online ads weaponised to deliver 'zero-click' spyware, researchers say
   11. bdnews24.com — Governments using online ads to secretly install spyware on targets, researchers say - Latest News
   12. www.theguardian.com — Online ads weaponised to deliver ‘zero-click’ spyware ...
   confidence 100%