New 'AdFection' Technique Allows Zero-Click Device Hacking via Online Ads

• Researchers at Citizen Lab have identified 'AdFection,' a cyberattack method that infects devices with malware simply by displaying an advertisement.
• No interaction or clicks are required from the victim for the infection to occur.
• The Israeli firm Discover-Tech is accused of using its position in the advertising ecosystem to facilitate the deployment of Candiru spyware.

Attack Tactics

• The attackers exploit the Real-Time Bidding (RTB) system to identify potential targets via advertising IDs and IP addresses.
• Through a platform named 'Controlium,' customers can specifically target devices to deliver malicious code instead of legitimate advertisements.
• Documented victims include staff at Al Jazeera, with evidence suggesting that networks belonging to NATO, defense ministries, and critical infrastructure were also targeted.

Industry Complicity

• Discover-Tech operated as a 'certified' partner for platforms like Google and IAB Europe, which provided a facade of legitimacy.
• Malicious ads were distributed through popular apps including Grindr, Badoo, Duolingo, and Viber.
• The findings highlight how the advertising industry's pervasive tracking apparatus has been repurposed for 'ADINT' (Advertising-based Intelligence) by state actors and surveillance firms.

Recommended Mitigation

• Security experts assert that ad-blocking software is now mandatory for IT security.
• Organizations are advised to enforce the use of ad-blockers and privacy-focused browsers on all corporate and government devices.
• Regulators must impose stricter oversight on the digital advertising ecosystem, enforce data protection laws, and sanction companies involved in the development or distribution of spyware via advertisement networks.