Citizen Lab’s investigation into AdFection found a campaign using ads and zero-click exploits to install malware.
Discover-Tech acted as an advertising partner, while Candiru (Integrity Labs) developed and distributed the malware.
The ads appeared on networks serving NATO, the UN, government bodies and critical infrastructure.
The investigation does not identify the specific security flaws used.
How was the attack carried out?
At the center of the activity was a company called Discover-Tech, which operated as an advertising network partner. The company used well-known networks, such as Google, Yandex, and Beeswax, to display ads that contained hidden programming code.
When the selected target viewed the ad, their device automatically connected to computers controlled by the company Candiru (also known as Integrity Labs). From there, the program was transferred that allowed full control of the device without any interaction from the user.
According to Citizen Lab’s investigation, Discover-Tech exploited ad targeting systems and GDPR regulations to target specific individuals. These ads appeared in sensitive locations, including NATO, UN, government agencies, law enforcement, and critical infrastructure networks around the world.
READ ALSO
Meta's new AI Muse chats freely with users about erotic topics
The reaction of companies
After the investigation was revealed, the companies that manage the advertising networks took measures:
- Google and IAB Europe have removed Discover-Tech from their lists of approved partners.
- Google has permanently terminated Discover-Tech's access to ad exchange platforms.
- Beeswax removed the company from its own platform.
- Vungle temporarily suspended their collaboration, pending further investigations.
- Eskimi proceeded to completely block the accounts and domains used by Discover-Tech.
User protection
Although the specific technical weaknesses that enabled these attacks were not made public, Citizen Lab suggests the following measures for greater security:
- Use of programs that prevent the display of advertisements (ad blockers).
- Reset the advertising ID in the settings of Android and iOS devices.
- Regular installation of all software updates recommended by device manufacturers.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)