Zero-click spyware attacks via digital advertising

Cybersecurity researchers have identified a sophisticated method of deploying spyware known as ‘AdFection’. This technique utilizes digital advertising systems to execute zero-click attacks, allowing malicious code to infect devices without any user interaction, such as clicking a link.

Research from Citizen Lab links this method to the Israeli advertising technology company Discover-Tech and its ‘Controlium’ platform. The findings suggest that surveillance partners use the platform to profile individuals and target devices, subsequently purchasing advertisements that direct users to spyware developed by Candiru (also known as Integrity Labs).

Further reports indicate that iPhone users have been specifically targeted. In one documented case, an employee of a financial institution was targeted through an Instagram advertisement for a football club, resulting in the theft of login credentials and the scanning of cryptocurrency wallets. Additionally, a campaign identified by Report URI involved the use of approximately 630 expired domains. Because these domains remained integrated into the infrastructure of thousands of legitimate websites for services like analytics, roughly 8,000 sites were found to be inadvertently directing visitors to malware infrastructure.