From WIRED · Matt Burgess · · 2m
Spyware spreads through targeted ads with zero clicks
Researchers find the first documented case of sophisticated malware infecting phones silently through digital advertisements, targeting journalists and government networks.
In brief
Researchers find the first documented case of sophisticated malware infecting phones silently through digital advertisements, targeting journalists and government networks. Citizen Lab researchers documented spyware infecting dozens of devices through targeted ads without user interaction, marking the first public…
Worst-case scenario found in the wild
Researchers at Citizen Lab at the University of Toronto revealed spyware silently infecting targets as they browse past ads in their daily digital lives on Thursday.
Campaign dubbed AdFection
An Israeli-registered advertising firm allegedly connected to servers linked to a spyware company and infected dozens of devices with invasive malware.
Zero-click attacks need no user action
Zero-click hacks automatically install malware on devices without requiring any interaction or missteps from the target.
Victims see nothing amiss
Bill Marczak, a senior researcher at Citizen Lab, says AdFection allows operators to automatically hack specific individuals with mercenary spyware as they use apps or browse the internet.
“AdFection allows operators to automatically hack specific individuals with mercenary spyware as they use apps or browse the internet.”
A nightmare scenario for users
People cannot protect themselves from zero-click ad attacks other than blocking ads thoroughly on all websites and platforms.
“The risk of having your device infected with spyware simply by using a website or app that displays ads is a nightmare scenario.”
Al Jazeera journalists targeted
During two thousand twenty-four and two thousand twenty-five, Citizen Lab concluded that forty-five devices belonging to the news outlet Al Jazeera were targeted with zero-click attacks delivered by ads.
Millions of devices directed to servers
Discover-Tech operates an advertising platform called Controlium that can allow its users to de-anonymize, fingerprint, and automatically infect devices once an ad appears.
Ads shown across millions of apps
By analyzing ad-bidding records publicly exposed on the Discover-Tech website, Citizen Lab researchers found ads linked to the firm with attacker script tags were shown in more than seventy thousand mobile apps and more than…
Government and NATO networks targeted
Citizen Lab researchers saw Discover-Tech ad impressions on government and national-security-linked networks around the world.
Google and industry bodies respond
Google terminated Discover-Tech's registration after collaborating with Citizen Lab and cybersecurity firm Confiant and confirming a spyware link.The Interactive Advertising Bureau Europe suspended Discover-Tech from its global vendor list following an audit of its policies.
Ad architecture must change
Bill Marczak says the ability to push individualized, arbitrary content at specific users is a hallmark of the modern online ads ecosystem and perfectly suited to the mercenary spyware industry.
“Until this architecture changes, or ad companies get serious about customer vetting, we're going to keep seeing this kind of abuse.”
The short version
Citizen Lab researchers documented spyware infecting dozens of devices through targeted ads without user interaction, marking the first public evidence of zero-click attacks via the ad ecosystem.
