From TechRadar · · 1m 50s
Spyware hidden in ads infected journalists' devices
Researchers discovered malware delivered through online advertisements that required no user interaction, targeting Al Jazeera journalists and potentially reaching Pentagon networks.
In brief
Researchers discovered malware delivered through online advertisements that required no user interaction, targeting Al Jazeera journalists and potentially reaching Pentagon networks. Israeli firms Candiru and Discover-Tech facilitated a zero-click spyware campaign through ads that infected at least forty-five Al…
The attack that needs no click
Researchers found a zero-click spyware campaign delivered through online advertisements. The malware infected devices with no user interaction required, just by serving the ad.
What the malware could do
The infostealer harvested files, documents, cookies, bookmarks and saved credentials. It captured keystrokes, took screenshots, and used microphone and camera to record users while working.
Who was targeted
Al Jazeera journalists noticed their devices acting strange in two thousand twenty-four and reached out to Canadian cybersecurity firm Citizen Lab, who confirmed the first-ever zero-click mercenary spyware attack delivered through online ads.
The campaign name
Researchers called the operation AdFection. Both Al Jazeera and Citizen Lab released their findings on the sophisticated attack.
Two Israeli companies involved
Candiru built the infostealer and delivery mechanism. Discover-Tech, an ad-tech company operating MyDSP, allegedly served the malicious ads through its infrastructure.
Candiru's history
Candiru, now known as Integrity Labs, is a mercenary spyware company. The US Department of Commerce blacklisted it in early November two thousand twenty-one but delisted it in late July two thousand twenty-six.
Discover-Tech's real purpose
Citizen Lab found Discover-Tech ads on more than seventy thousand mobile apps and one hundred twenty thousand websites in Q two two thousand twenty-six alone. Researchers questioned if it was ever a legitimate business.
“"it appears that serving as this bridge is Discover-Tech's primary purpose."”
Scale of the compromise
At least forty-five devices belonging to Al Jazeera were compromised in two thousand twenty-four and two thousand twenty-five.
What to remember
Israeli firms Candiru and Discover-Tech facilitated a zero-click spyware campaign through ads that infected at least forty-five Al Jazeera devices in two thousand twenty-four and two thousand twenty-five.
