Citizen Lab report: Exposing AdFection How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware /This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Candiru’s spyware. We also uncover Discover-Tech, and show how the company helps mercenary surveillance vendors track and hack devices around the world./ https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-... ----- Tweet sul tema: https://x.com/leahfiles/status/2111094612399960459?s=20 BREAKING: Israeli spyware is confirmed on our phones. This should be headline news but none of our mainstream media is covering it, of course. So we will. An Israeli ad company called Discover-Tech used ordinary online ads to plant spyware on people’s devices, and nobody had to click anything. The ad just had to load on a website or inside an app for you to be infected. Citizen Lab and the ad security firm Confiant published the findings yesterday. Researchers went through roughly 4 billion ad-bidding records and found Discover-Tech ads running on more than 120,000 websites and 70,000 apps between March and June of this year. Confiant says the company was serving at least 10 million ads a day. The platform was called Controlium. According to Citizen Lab, it let spyware companies use ad auctions to profile and unmask users, then send an infected ad to the one person they wanted to hack. The ads were also pulling cookies and login tokens from the sites they ran on. Israeli corporate records list Dekel Boni as the company’s founding director and sole shareholder. The main spyware customer was Candiru, the Israeli firm the U.S. government blacklisted in 2021, which now goes by Integrity Labs. Five years after that blacklisting, it was still reaching devices through ad inventory on Google, Comcast-owned Beeswax and Russia’s Yandex. Google had Discover-Tech on its approved vendor list from 2020 until this week. At least 45 Al Jazeera devices were targeted in 2024 and 2025. Candiru’s 2021 shareholder filings reportedly listed a minority investor described as a proxy for Qatar’s sovereign wealth fund, and Qatar also funds Al Jazeera. If that holds up, Qatari state money was sitting inside the company whose spyware was later aimed at Qatar’s own news network. The heaviest targeting was in the Palestinian territories, where Discover-Tech served almost 2% of all digital ads and about 10% on April 7. Traffic also reached the Armenian prime minister’s office, courts, universities and defense organizations. Google and the other ad platforms cut Discover-Tech off after the report came out. What nobody has answered yet is who paid for the ad buys, and how a company working with a U.S.-blacklisted spyware vendor passed vendor review for six years. I am going to look into this today to see if we can figure out who was buying the ads. Interesting timing considering my article yesterday.... Here's what to do to protect yourself: (1) Use an ad blocker. Citizen Lab calls ad-blocking a cybersecurity best practice and says there is no consistently safe way to be exposed to targeted ads. On iPhone, add a Safari content blocker. On Android, use Brave or Firefox with uBlock Origin. Ad blockers only work in your browser, not inside apps, so it also helps to delete free ad-supported apps you don’t need. Kill your advertising ID. (2) iPhone: Settings > Privacy & Security > Tracking, and turn off “Allow Apps to Request to Track.” Then Settings > Privacy & Security > Apple Advertising, and turn Personalized Ads off. (2) Android 12 or later: Settings > Privacy > Ads > Delete Advertising ID. Then in Settings > Google > All Services > Privacy & security > Ads
Ads privacy, turn off Ad topics and Ad measurement.
(3) Windows 11: Settings > Privacy & Security > General, and turn off personalized ads using your advertising ID. (4) Update your phone and restart it often. Many zero-click exploits don’t survive a reboot, so a daily restart forces attackers to reinfect you. Stay tuned!