Israeli digital ad agency caught serving first in-the-wild zero-click spyware

Israeli digital advertising agency Discover-Tech has been caught serving millions of online adverts that installed spyware on the phones of targets around the world.

Through a zero-click technique dubbed "AdFection", Discover-Tech's Controlium platform has been used by financially motivated customers to de-anonymize, fingerprint, and automatically infect devices the moment an advertisement is rendered.

Apps found displaying Discover-Tech ads include Duolingo, dating apps, period trackers, German weather apps, Yahoo Mail, Viber, and calling apps such as Truecaller.

This is the first example, said Citizen Lab, of in-the-wild infection of devices with zero-click mercenary spyware via targeted advertisements.

The spyware, said Citizen Labs, was used against dozens of devices belonging to journalists who reported on sensitive subjects at Qatari news network Al Jazeera. Its ads also appeared in critical networks used by the Pentagon, the United Nations International Atomic Energy Agency and the International Criminal Court.

And it's also been used to hit media organizations in Austria, Denmark, France, Mexico, Israel, Italy, Norway, and Sweden, as well as networks of international media services.

"Discover-Tech presents itself as a legitimate online advertising business. In fact, the Israel-based company provides a bridge between multiple mercenary spyware companies engaged in hacking and the legitimate online advertising ecosystem," the researchers said.

"We have found billions of instances of Discover-Tech bidding to send such advertisements to users, and no sign that the company is engaged in any legitimate advertising business activities."

The firm's Controlium platform, the researchers said, allows mercenary spyware firms to infect targets via online ads. After mass-profiling and deanonymizing millions of users, they can then covertly hack individual targets by sending them seemingly harmless ads containing zero-click exploits to install spyware on their devices.

The device is sent malicious JavaScript code, which is executed by the browser or app and then exploits and infects the device.

Controlium's users include mercenary spyware company Candiru – reportedly now owned by US-based Integrity Labs. This firm has already been called out by the US Commerce Department for developing spyware used to target government officials, journalists, businesspeople, activists, academics, and embassy workers.

The platform's also linked to Israel-based Bindecy, which specializes in zero-click mobile exploits, and another mercenary surveillance firm called Intelos.

"Our analysis reveals a dangerous lack of due diligence in the advertising ecosystem that Discover-Tech actively exploited. Despite supporting mass-profiling and mercenary spyware hacking, Discover-Tech has nonetheless appeared on several lists of "certified" and "approved" advertising vendors maintained by Google and IAB Europe, the advertising industry association," the researchers said.

"The fact that a "certified" company could target millions of users for years with no signs of legitimate activity highlights the dangerously inadequate controls over a sector that by its very nature touches almost every individual with a mobile device or a web browser in extremely invasive ways."

Google and digital marketing and advertising platform IAB Europe have now removed Discover-Tech from their ad vendor lists.