AdFection: how mercenary spyware compromises victims' devices through targeted ads

The University of Toronto's Citizen Lab has disclosed a zero-click spyware delivery method called AdFection, in which attackers use targeted ads to make devices automatically connect to mercenary spyware servers such as Candiru. Citizen Lab says the Israeli company Discover-Tech, ostensibly an advertising firm, actually facilitates several mercenary spyware partners, including Candiru, and that its ads directed millions of devices to Candiru servers, possibly for large-scale tracking and surveillance. The research says at least 45 devices at Al Jazeera were hit by zero-click attacks linked to Candiru, and that between March and June this year Discover-Tech's ads appeared on more than 120,000 websites and more than 70,000 mobile apps; according to an investigation by ad security company Confiant, the ads also appeared on networks including the U.S. Department of Defense, NATO, and the International Atomic Energy Agency.