Citizen Lab says AdFection used ads to deliver Candiru spyware
Original title: 'AdFection' Turns Ad Impressions Into Zero-Click Spyware Delivery
Discover-Tech allegedly helped infect at least 45 Al-Jazeera devices without a victim click.
University of Toronto's Citizen Lab says an Israeli ad-tech firm, Discover-Tech, used a method it calls AdFection to help spyware vendor Candiru infect devices. The report says at least 45 devices belonging to Al-Jazeera personnel were infected, with no click required, by abusing real-time ad auctions that can expose IP addresses, mobile advertising IDs, and cookies. Candiru, which now calls itself Integrity Labs, was previously placed on the US Commerce Department Entity List for supplying spyware to foreign governments. The visible report contrasts the method with earlier zero-click commercial spyware cases.
Unconfirmed: The infections and Discover-Tech's role are alleged by Citizen Lab; the article text is cut off before the full chain.
- Citizen Lab says at least 45 Al-Jazeera devices were infected.
- Auctions can expose IP addresses, mobile advertising IDs, and cookies.
- Candiru now calls itself Integrity Labs.
- The US Commerce Department previously put Candiru on its Entity List.
Impact: Covert spyware infection via targeted ad impressions
- Vendors
- Discover-Tech
- Threat actors
- Candiru
- Victims
- Al-Jazeera
- Countries
- IsraelUnited States
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 1c2aabfd84ee444c2beef25136dfec60 | -malware-ordinary-text#recipe=similar-items&sourcecontentid=1c2aabfd84ee444c2beef25136dfec60) Foul Language: WordlistLoader Disguises Malware as Ordina |
| md5 | 7486718f7a62752999d0495329bf013f | vacy-labels-not-enough#recipe=similar-items&sourcecontentid=7486718f7a62752999d0495329bf013f) Inconsistent Privacy Labels Don't Tell Users What They Ar |
| md5 | d9df486703c0658d61328abeecea24e8 | -enterprises-end-users#recipe=similar-items&sourcecontentid=d9df486703c0658d61328abeecea24e8) While ECH Adoption Is Low, Risks Remain for Enterprises, |
| md5 | df597938562f99076cea6fb837c75196 | out-data-populating-ai#recipe=similar-items&sourcecontentid=df597938562f99076cea6fb837c75196) Do We Know Enough About the Data Populating AI? by Adam S |
From the original article
9 min read at darkreading.com
Spyware vendors are exploiting targeted ad bidding in the digital ecosystem to identify and track individuals and organizations of interest.
By Jai Vijayan · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.