Mercenary spyware may have ridden into victims’ devices on nothing more than an ordinary web ad for earbuds or a novelty air freshener, researchers at the University of Toronto’s Citizen Lab report.
They have given the technique a name: AdFection. Under this model spyware is distributed on a zero-click basis, meaning an infection proceeds without the victim tapping or clicking anything at all. Singled out in the report is Discover-Tech, an Israeli firm whose public face is that of a run-of-the-mill advertising company but which, the researchers allege, acts as a facilitator for multiple mercenary spyware partners — among them the prominent vendor Candiru.
Millions of devices are quietly steered toward Candiru’s servers by those ads, the findings state. Rather than compromising each user who encounters the ad, Citizen Lab believes the objective is to assemble a large pool of devices that can then be screened for surveillance targets.
Because the delivery route passes through the ad networks that publishers and platforms depend on for revenue, the online advertising industry and its regulators both face hard questions. Ordinary ad traffic and a live campaign of this kind are nearly impossible to tell apart.
Citizen Lab is publishing the first technical account of the method, and the details are likely to sharpen scrutiny of the commercial spyware trade and the advertising middlemen that carry it.
