- Citizen Lab and Confiant report that Discover-Tech, a purported ad firm, used ads to infect devices of at least 45 Al Jazeera journalists.
- The attack needed no click, so training staff to avoid bad links does not cover it. The ad route is a question for security teams.
- Ask which ad networks reach staff devices, who is most likely targeted, and whether anyone would notice odd traffic after a page loads.
Most security training teaches one habit: do not click the strange link. A new report describes an attack where that habit does not help. The victim only has to load a page that shows an ad.
The Record reported on October 15 on two parallel investigations. One came from Citizen Lab, a digital forensic research institute. The other came from Confiant, a security firm that focuses on ad technology. Together they traced a campaign run by Discover-Tech. The Israel-based firm is described as a purported advertising company. Its ads infected devices used by at least 45 Al Jazeera journalists.
The idea: the ad is now a delivery route
This shows where trust has moved. An ad looks like harmless filler from a stranger. Here it was the way in. That reading is ours, built on what the researchers found.
The reach went beyond newsrooms. Dozens of public bodies and global institutions had ads from the same system shown on their networks. Citizen Lab found ads on devices in "national-security-sensitive networks around the world," NATO among them. The report did not say how many officials' devices were compromised.
How the attack works
Discover-Tech runs a platform called Controlium. Its customers are spyware companies. The report says it can unmask a visitor, fingerprint the device and infect it the moment an ad appears. That is a zero-click attack. The victim does nothing.
Unmasking means matching pseudonymous data with public data. An anonymous visitor then gets a name. Fingerprinting means reading small details of a device so it can be recognised again. Together they let an attacker single out a chosen target.
When that target visits a page with one of these ads, malicious JavaScript runs automatically. The researchers said Discover-Tech keeps the harmful code away from the firms that serve and show the ads. It does not even share pointers to it. That may leave ad vendors with nothing obvious to block.
Citizen Lab alleges that Candiru, an Israeli spyware maker, hired Discover-Tech to place the ads. According to the report, Al Jazeera reporters were among Candiru's surveillance targets, along with others. The U.S. Commerce Department blacklisted Candiru in 2021. Its software has long been used against civil society.
The route let spyware operators skip two usual hurdles. One is the rule that only government officials may buy the software. The other is the need to trick people into acting.
The scale the researchers measured
Citizen Lab studied four billion ad placement records from Discover-Tech. Over just four months, it said, the corrupted ads allegedly appeared in Android and iOS apps and on nearly 200,000 unique websites. The ads sent millions of devices to Candiru's servers, the report said. The likely aim was tracking and reconnaissance.
Confiant studied targeting data on its own. It found signs that the ads were shown on networks at the U.S. Department of Defense, Estonia's Information System Authority, the International Atomic Energy Agency and the International Criminal Court. An ad shown on a network does not prove infection. The report does not claim it does.
Who carries the risk
The report says those infected include journalists, dissidents, embassy staff and officials. On an infected device, Citizen Lab said, an operator gets a wide view of the owner's private life. That covers calls, nearby conversations picked up through the microphone, and stored messages and email.
No one can be expected to judge an ad this way. The burden falls on the systems around people, not on their judgment.
The report names a second actor, Dark Cartographer. It also uses Discover-Tech's software. It exploits weaknesses in mobile carriers to tie a phone's advertising ID to its phone number. The report says this made mass unmasking of people easier.
Google and other major platforms have blocked Discover-Tech since the research. Citizen Lab says the lack of regulation in digital advertising needs to change. It asks ad vendors to strengthen threat detection and to vet and audit their partners regularly.
What leaders should ask
Your company cannot decide how the ad industry screens its customers. You can learn your own exposure. Put these questions to your security team.
First, which staff are likely targets? Think of executives, legal, communications and anyone who deals with governments. Second, do those people use managed devices with ad blocking or content filtering? Third, do company apps on staff phones load ads from outside networks? Fourth, if a device contacts an unknown server after a page loads, would anyone see it?
If your firm sells ads or runs an ad platform, add a fifth question. How do we vet the advertisers and partners behind our supply chain?
The careful employee used to be the last line of defence. This report describes an attack that needs no mistake at all.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: The Record.
