Zero-click spyware infects phones through targeted ads

Summarised from 3 outlets · Updated 15 Oct, 12:20 · Archive

Researchers have found sophisticated mercenary spyware being distributed through online advertising without requiring user interaction.

Researchers at The Citizen Lab have documented a campaign called 'AdFection' in which an Israeli-registered advertising firm allegedly connected to spyware company servers infected dozens of devices with sophisticated mercenary spyware. This is the first detailed technical evidence made publicly available of spyware infecting devices via digital ads.

Zero-click attacks are particularly dangerous because they automatically install malware without any user interaction or mistake by the target. Such attacks have typically exploited vulnerabilities in mobile messaging apps, but this campaign shows attackers merging these techniques with the online ad ecosystem to distribute malware.

According to Bill Marczak, a senior Citizen Lab researcher, 'AdFection allows operators to automatically hack specific individuals with mercenary spyware as they use apps or browse the internet.' A victim would see no signs of the attack and might not even see any ad at all. Wolfie Christl, another Citizen Lab researcher, called the risk 'a nightmare scenario,' noting that protecting against such attacks is extremely difficult beyond blocking ads thoroughly on all websites and platforms.

How it is being reported

• New ‘zero-click’ spyware hacked phones using targeted adsCitizen Lab researchers uncover Israeli-developed ‘AdFection’ technique that requires no interaction from victim to infect devicesFinancial Times · 15 Oct, 11:00
• Citizen Lab says governments are abusing online ads to hack people with ‘zero-click’ spywareThe digital rights unit found evidence that dozens of devices at media organization Al Jazeera were hacked after being shown malicious online ads.TechCrunch · 15 Oct, 11:00
• ‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted AdsResearchers at The Citizen Lab have for the first time released technical evidence of sophisticated mercenary spyware being distributed via online advertising.Wired · 15 Oct, 11:00

In this story: The Citizen Lab · Bill Marczak · Wolfie Christl · Israel

This summary was written by AI from the headlines and standfirsts above, and states as fact only what at least two outlets report. How we use AI · Report a problem