Citizen Lab has published what it calls the first technical evidence of mercenary spyware delivered through targeted online advertising with no user interaction, naming an ad-tech company it calls Discover-Tech. The technique, dubbed AdFection, exploits real-time ad bidding: a tag inside a rendered ad contacts a Discover-Tech server with the device's IP address, advertising ID and cookies, and the server returns JavaScript only when the device matches targeting criteria. The strongest evidence concerns Candiru — now Integrity Labs, which the US Commerce Department placed on its Entity List — and at least 45 devices belonging to Al Jazeera personnel; network logs the broadcaster supplied show infected devices contacting Discover-Tech infrastructure, then Candiru validator servers and finally a Candiru command-and-control server. Discover-Tech's Controlium platform served targeted ads to almost 200,000 unique websites and Android and iOS apps over four months, including on devices associated with government, military, critical-infrastructure and media organisations across dozens of countries. Google terminated its ad-exchange access, and IAB Europe, Beeswax, Eskimi and Vungle moved to cut it off. Ad impressions became an unauthenticated infection vector.

• Source article