Discover-Tech ads delivered Candiru spyware to Al Jazeera
Original title: How Discover-Tech turned targeted ads into a pipeline for zero-click spywares
Citizen Lab says Controlium infected devices when ads rendered, and those ads reached almost 200,000 sites and apps.
Citizen Lab reports that Al Jazeera devices were infected with Candiru spyware, rebranded as Integrity Labs, through targeted ads bought by Israeli firm Discover-Tech. Its Controlium platform is said to fingerprint devices and infect them when an advertisement renders, an attack the lab calls AdFection. Analysis of four billion bidding records over four months found ads on almost 200,000 websites and apps. Google, IAB Europe, Beeswax, Vungle, and Eskimi later cut Discover-Tech’s ad access.
Unconfirmed: Device contact with Candiru servers is described as likely reconnaissance, and DARK CARTOGRAPHER findings are reserved for a later report.
- Candiru was rebranded as Integrity Labs, the report says.
- Ads also sent millions of devices to Candiru servers for tracking.
- Discover-Tech is also linked to Intelos and Bindecy.
- DARK CARTOGRAPHER is tied to carrier deanonymization via the same infrastructure.
- The lab asked regulators to investigate Discover-Tech and Candiru.
Impact: zero-click spyware infection and large-scale device tracking
- Products
- Controlium
- Threat actors
- CandiruIntegrity LabsIntelosBindecyDARK CARTOGRAPHER
- Victims
- Al Jazeera
- Organizations
- Discover-TechGoogleIAB EuropeBeeswaxVungleEskimi
- Countries
- Israel
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | fearevolve.com | e attack, Fingerprint C1 . Four of the servers matched it ( fearevolve[.]com , insightenterprisells[.]com , jobmarcher[.]com , plastic |
| domain | insightenterprisells.com | nt C1 . Four of the servers matched it ( fearevolve[.]com , insightenterprisells[.]com , jobmarcher[.]com , plasticbells[.]com ). We could not l |
| domain | jobmarcher.com | atched it ( fearevolve[.]com , insightenterprisells[.]com , jobmarcher[.]com , plasticbells[.]com ). We could not locate a response in |
| domain | keyadapter.com | developed a fingerprint for Candiru validator servers. Both keyadapter[.]com and sharethere[.]net returned banners that matched the fo |
| domain | plasticbells.com | lve[.]com , insightenterprisells[.]com , jobmarcher[.]com , plasticbells[.]com ). We could not locate a response in Internet scanning da |
| domain | sharethere.net | nt for Candiru validator servers. Both keyadapter[.]com and sharethere[.]net returned banners that matched the following regular expre |
| sha256 | 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8 | is available on VirusTotal. Candiru spyware sample SHA256: 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8 This sample hard-codes two C&C servers that match Fingerpri |
From the original article
14 min read at citizenlab.ca
Devices at international news network Al Jazeera were infected with mercenary spyware from Candiru (rebranded as “Integrity Labs”) via targeted online advertisements. We provide the first public technical confirmation of a zero-click mercenary spyware attack delivered via targeted advertising, which we call AdFection .
By citizenlab.ca via ache · citizenlab.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.