The Record reported on 15 October that Citizen Lab and the security firm Confiant found an Israel-based company, Discover-Tech, using online ads to infect devices. Citizen Lab calls this a zero-click attack, meaning that simply seeing the ad is enough. The Record says devices used by at least 45 Al Jazeera journalists were infected. Citizen Lab says the spyware maker Candiru allegedly hired Discover-Tech to send the ads. Researchers studied four billion ad records. Over four months, the ads allegedly ran in mobile apps and nearly 200,000 websites. The Record says Google and other major platforms have now blocked Discover-Tech.
Citizen Lab said the ads appeared on sensitive networks around the world, including NATO. Confiant's targeting data suggests they also ran on networks at the US Defense Department, Estonia's information systems agency, the IAEA and the International Criminal Court. The Record says the report did not state how many officials' devices were compromised. No full count of infected devices has been given.
Citizen Lab says an online ad can carry code that runs inside the app or browser showing it. Teams that sell ad space or buy ads depend on their ad vendors to stop this. Citizen Lab urges those vendors to vet and audit their business partners.