New 'AdFection' Cyberattack Targets Al Jazeera via Online Ads

Key Takeaways

• Researchers at the Citizen Lab at the University of Toronto have identified a novel hacking method dubbed "AdFection" used to target Al Jazeera.
• The attack delivers the Candiru spyware to devices through online advertisements without requiring any user interaction or clicks.
• At least 45 Windows devices were reportedly compromised using this method.

Mechanics and Actors

• The Israeli firm Discover-Tech Ltd. is identified as the central player, acting as a seemingly legitimate advertising entity to inject malicious code.
• The attackers leverage the existing digital advertising infrastructure, including real-time bidding, to profile potential targets and serve weaponized ads directly to their devices.
• Technical evidence indicates the same infrastructure may have been used to target the Saudi Arabian Ministry of Foreign Affairs.

Implications

• The spyware developer, associated with Integrity Partners, is currently subject to US export restrictions for enabling malicious targeting of journalists, government officials, and activists.
• Reports suggest several governments, including potentially Germany, have previously acquired or utilized Candiru's technology.
• This incident highlights the vulnerability of media professionals to ad-based mass surveillance and targeted espionage; notably, German MEP Daniel Freund was previously targeted by a similar Candiru-based attack in 2024, which he suspected originated from Hungarian intelligence services, though it ultimately failed.