No click required: How the ad industry became a pipeline for mercenary spyware
Citizen Lab says Discover-Tech used ad auctions to profile devices and deliver Candiru spyware without a click.
The Citizen Lab says Discover-Tech used its Controlium advertising platform, described as AdFection, to win real-time ad auctions, fingerprint devices, and silently deliver exploit code when an ad rendered. Over four months its ads appeared on about 120,768 websites and in 75,373 apps, including impressions on networks associated with NATO and major technology companies; an impression alone is not an infection. Israeli mercenary-spyware vendor Candiru used the path to infect devices at Al Jazeera. Google, IAB Europe, Beeswax, Vungle, and Eskimi removed Discover-Tech’s access after disclosure.
74