Two senators say that revelations about online targeted advertising being used as a vector for spyware infections underscore the need for better security practices in the industry.

Some members of the advertising industry that were subjects of the report, meanwhile, think their practices are up to the task.

The Citizen Lab at the University of Toronto, in partnership with the cybersecurity and ad-tech firm Confiant, last week published a report on AdFection, a technique whereby targeted ads were delivering zero-click mercenary spyware.

“Ad vendors must significantly level up their cybersecurity and threat detection capacity to effectively cut off malicious advertisers across the supply chain,” The Citizen Lab report states. “They must rigorously and regularly vet, screen, and audit their business partners and hold them accountable for their own supply chains.”

In 2023, Democratic Sens. Ron Wyden of Oregon and Cory Booker of New Jersey introduced legislation to ban advertising networks and facilitators from using personal data to target, but the legislation never advanced past introduction. Both said The Citizen Lab report illustrated the need for industry reform.

“The report underscores the growing risk of spyware and the increasingly sophisticated methods used to track and target people online,” Booker said in a statement to CyberScoop. “Americans need vastly stronger privacy protections that stay ahead of these evolving surveillance threats.”

The security threat of targeted online advertising to government devices is of particular concern to Wyden, with his letters to government agencies cited in the report. Wyden has called adtech a national security threat. Ads from Discover-Tech, the company most linked to AdFection, got impressions on government networks.

“Allowing targeted ads on government devices is an open invitation to spies and criminals. It’s the digital equivalent of leaving all the doors and windows unlocked at a sensitive government facility,” he said in a statement to CyberScoop.

“It’s clear that advertising exchanges are not meaningfully protecting users against malware and location tracking, which is why I’ve been urging the government to disable ads on government browsers and turn off mobile ad IDs, and have pushed my bill to ban all targeted advertising,” he continued. “The latest Citizen Lab report is an impressive reminder that this sector simply cannot be trusted to put users’ security ahead of profits.”

A number of U.S. agencies have taken steps to block ads due to the threats they pose, or recommended blocking them for feds.

Discover-Tech appeared on lists of “certified” and “approved” vendors that Google and the advertising industry association IAB Europe maintained. Google participated in the report, but IAB Europe didn’t respond to it until after publication. Both provided additional comments to CyberScoop.

Google and IAB Europe, and the ad networks Beeswax, Vungle and Eskimi all took steps to remove Discover-Tech’s access to the digital advertising ecosystem, according to the report. A mix of other ad systems replied to The Citizen Lab, but some did not, including Microsoft, which owns the ad system Xandr. Microsoft also didn’t respond to requests for comment from CyberScoop.

The Citizen Lab report concluded that the advertising industry displayed “a dangerous lack of due diligence” and criticized “broken digital infrastructure,” while also saying that the sector needed to “get serious” about security.

It said ad vendors needed to better share threat data, improve vetting of partners, audit vendor registries and ban vendors by default in jurisdictions known to be permissive of abuse.

In response to questions from CyberScoop about those conclusions, a Google spokesperson provided a statement.

“We banned Discover Tech during a joint investigation with Citizen Lab and Confiant,” the spokesperson said. “Throughout that work, we continuously blocked malicious ads to help people stay protected while we dismantled the network.”

Google said that its safety teams and systems continuously blocked individual bad ads from Discover-Tech, but banning them entirely from the platform required proof that their ad infrastructure was linked to spyware.

The company also said it regularly audits participants in its Authorized Buyer program, as well as deploying “multi-layered defenses to stop bad ads,” and that its automated systems detected over 99% of policy-violating ads before reaching users last year.

IAB Europe responded more specifically.

“The findings do not demonstrate that the digital advertising infrastructure is broken, but rather point to the potential misuse of existing technologies and functionalities that are not specific to digital advertising but inherent to web technologies,” said Lauren Wakefield, marketing and communications director for the association. “While the industry continuously invests in improving security and safeguards against fraud and other forms of misuse, the investigation of potentially unlawful activities, such as the deployment of spyware, ultimately falls within the remit of competent authorities.”

The Citizen Lab report also urges regulators to take action, including conducting an investigation of Discover-Tech and the spyware firm Candiru, which infect users through Discover-Tech online ads; “more closely scrutinize the advertising ecosystem to determine whether other companies are leveraging it for espionage and spyware delivery, and determine whether they have violated applicable laws and regulations;” and pursue sanctions against mercenary spyware firms and the companies that enable them.

“Preventing fraud and other forms of misuse is already an ongoing priority across the digital advertising ecosystem, and IAB Europe supports industry efforts to invest in technologies, processes and safeguards to identify and mitigate cybersecurity risks,” Wakefield continued. “We hope this report will be seen as an opportunity to reassess and improve existing approaches to cybersecurity. It is important to recognise that cybersecurity requirements and measures must be proportionate to the risks and circumstances of each individual company, which is why one-size-fits-all recommendations may not always be appropriate.”

The post Senators say targeted ads are a security risk. Ad groups say the critics are off base. appeared first on CyberScoop.

That online ad you saw for earbuds, a drone or bubble gum-scented car air freshener may have been a gateway for mercenary spyware that can infect your device without you ever having to click on it.

The Citizen Lab at the University of Toronto on Thursday said it was revealing the first details of zero-click spyware being delivered through targeted advertising, which it’s calling AdFection. It concluded that while the Israeli company Discover-Tech presents itself as a legitimate advertising firm, in actuality it operates as a facilitator for multiple mercenary spyware partners, including the well-known Candiru. Its ads covertly direct millions of devices to contact Candiru’s servers.

The likely goal, according to the researchers, is large-scale tracking and surveillance, enabled by accident by major industry players like Google. The campaign led to the infection of devices at media outlet Al Jazeera, they said, but Discover-Tech’s ads have also appeared on many sensitive networks around the world, including at the U.S. Department of Defense, NATO, the International Atomic Energy Agency and world cybersecurity agencies, according to partner investigators at ad security firm Confiant.

It’s a discovery that the researchers said raises uncomfortable questions for regulators, whom The Citizen Lab said need to investigate Discover-Tech and levy sanctions, and for the online advertising industry.

“The adtech industry, the digital advertising industry, has a lot of rethinking to do to reconsider how they approach these threats of surveillance and the responsibilities that they have with the data that they collect and how it might be abused,” said Jerome Dangu, chief technology officer and co-founder of Confiant. “The industry has optimized against cyber criminals, scams and malware for profit that targets people for extracting money, but not for surveillance.”

Wolfie Cristl, senior researcher at The Citizen Lab, said it was “disastrous” that ad vendors didn’t detect the operation for years. Discover-Tech was registered in 2020 and has facilitated mercenary spyware since at least 2024. The activities of a shadowy outfit that the researchers dubbed DARK CARTOGRAPHER, which involves Discover-Tech and other vendors — including an unnamed U.S. intelligence contractor — date back to 2019.

“Digital advertising is broken. The way the online advertising ecosystem works today is a security threat for states, the private sector, civil society and everyone else alike,” Cristl said. “Cybersecurity agencies, regulators and lawmakers in the U.S., Europe and other regions must urgently step in. They must investigate the involved companies and fix the systemic risks that enable malicious ad targeting.”

Earlier reports have touched on the existence of mercenary spyware that can infect users through online ads, but Thursday’s research marks the first technical demonstration of infections and distribution through targeted advertising.

The Citizen Lab can’t currently attribute the AdFection attacks to any specific party.

Discover-Tech has appeared on lists of “certified” and “approved” vendors maintained by Google and IAB Europe, an advertising industry association. In response to the research, Google has removed Discover-Tech from its vendor registries and ended its access to Google ad platforms, while IAB Europe has removed Discover-Tech from its global vendor list.

Between March and June of this year, the researchers found Discover-Tech ads displayed in over 120,000 websites and over 70,000 mobile apps.

The Citizen Lab said that at least 45 devices at Al Jazeera were targeted in zero-click attacks that it linked with high confidence to Candiru spyware delivered by Discover-Tech’s ads.

Candiru spyware has shown the ability to take over a device remotely, steal data from it, access its microphone and camera, and more. Researchers discovered that in addition to Candiru, Discover-Tech has connections to another mercenary hacking firm, Bindecy, and a mercenary ad intelligence firm, Intelos.

Furthermore, the report states, “Discover-Tech operates a platform called Controlium that enables its mercenary surveillance partners to de-anonymize, fingerprint, and automatically infect devices the moment an advertisement is rendered.”

The DARK CARTOGRAPHER role is more mysterious.

“A separate threat actor we call DARK CARTOGRAPHER is using Discover-Tech’s infrastructure to exploit vulnerabilities across numerous mobile carriers to link device advertising IDs with phone numbers, mass-deanonymizing internet users. We will detail our findings concerning this threat actor in a separate forthcoming report,” Thursday’s report states. “Notably, DARK CARTOGRAPHER infrastructure links to both a mercenary adtech vendor and a U.S. government contractor. It is rare to see such direct overlaps between mercenary vendors and U.S. government or intelligence contractors.”

Discover-Tech, Candiru, Bindecy and Intelos did not respond to The Citizen Lab’s letters seeking comment.

The post AdFection: How mercenary spyware invades victims’ devices through targeted advertising appeared first on CyberScoop.