Targeted ads delivered 0-click exploits to install mercenary malware

Among the major vendors that listed Discover-Tech as a “certified” or “verified” vendor were Google and the advertising industry association IAB Europe. The Israeli firm also used European General Data Protection Regulation (GDPR) consent frameworks to target users within the European Union. Discover-Tech has served ads through major networks such as Google, Yandex, and Beeswax.

Google and IAB Europe have since removed Discover-Tech from their ad vendor registries, and Google further terminated Discover-Tech’s access to its ad exchange platforms. Beeswax has removed Discover-Tech from its ad buying platform. Fellow ad platform Vungle (Liftoff) paused Discover-Tech’s access while conducting a review, and Eskimi blocked Discover-Tech’s accounts and domains.

Thursday’s report said that Discover-Tech ad impressions have appeared on government and national-security-linked networks throughout the world: NATO, United Nations networks, European lawmaking bodies, critical infrastructure providers in Australia, and armed forces and government agencies in Norway and Sweden.

“Discover-Tech’s mass abuse, privacy invasion, and facilitation for mercenary spyware attacks illustrates structural flaws with the online advertising system, which failed to detect or prevent the abuse documented in this report,” Citizen Lab said.

The research lab said that the mercenary malware installed through AdFection was developed and distributed by Candiru (rebranded as “Integrity Labs”). Under the arrangement with Discover-Tech, targets with specific profiles of interest to the Candiru customers received ads that carried JavaScript or other code that connected to Candiru’s control servers. In response, those servers delivered an exploit that served the zero-click payload when the ad appeared on an individual’s device.

The research doesn’t describe the vulnerabilities exploited in the zero-click attacks or the final malware that was installed in them. It’s likely they were zero-days that have been fixed after Citizen Lab discovered the campaign. Citizen Lab didn’t immediately respond to questions.

Messages sent to Discover-Tech and Candiru went unanswered.

Citizen Lab called on advertisers and government officials to take concrete action to proactively prevent campaigns like AdFection. Beyond that, users can reduce the risk of being infected by installing ad blockers, resetting mobile advertising ID in iOS and Android settings (it’s unclear why the researchers didn’t advise turning off personalized ads altogether), and installing ad-blocking software on home or office networks. As always, installing updates in a timely manner is also a must.