An Israeli marketing agency has run advertisements visible to millions of online users, potentially exposing them to spyware attacks, as detailed in a recent study by the University of Toronto’s Citizen Lab.
According to the report published on Thursday, Discover-Tech is accused of purposefully managing a platform that enables its associates to de-anonymize, fingerprint, and automatically infect devices with spyware. These associates can then distribute malicious content to specific users alongside advertisements.
Over a span of four months, Discover-Tech ads were displayed on over 120,000 websites and 75,000 apps across numerous countries, posing a threat to the security of sensitive networks like government ministries, armed forces, and multinational organizations like NATO. The report, accompanied by a related investigation from U.S.-based cybersecurity firm Confiant, highlighted the alarming convergence of targeted advertising and mercenary spyware industries.
Ron Deibert, director of Citizen Lab, described the findings as a “worst-nightmare” scenario, emphasizing the global scale of espionage uncovered.
Concerns about companies peddling spyware to repressive governments have long been raised by rights groups. The report sheds light on how targeted ads, a fundamental part of the advertising ecosystem, can facilitate “zero-click” spyware attacks, where devices are infected without user interaction.
In the case of Discover-Tech, the report revealed that zero-click attacks were orchestrated through their ads, displaying on reputable news outlets’ websites like CBC, BBC, and the New York Times. Deibert noted the challenge faced by these organizations in preventing such infiltrations, attributing it to the standard operation of the advertising ecosystem.
Despite CBC News’ attempts to reach Discover-Tech for comment, the company did not respond. The head of public affairs at CBC informed that their logs did not show any ads delivered by Discover-Tech, prompting an escalation to Google for verification.
The report also disclosed a targeted spyware attack on Al Jazeera, with dozens of their devices allegedly infected through Discover-Tech ads. The researchers linked these attacks to spyware from Candiru, now rebranded as Integrity Labs, based in Israel.
The U.S. Department of Commerce sanctioned Candiru in 2021, citing the company’s supply of spyware to foreign governments for malicious purposes. Efforts to reach Candiru for comments were unsuccessful.
Al Jazeera strongly condemned the spyware attack on its staff, denouncing it as a deliberate assault on press freedom. Calls for an independent investigation to identify and hold the perpetrators accountable were made.
Experts and regulators urge heightened cybersecurity measures by ad vendors to combat malicious advertisers and advocate for thorough investigations to uphold privacy and security laws.
Google confirmed blocking Discover-Tech from its ad platforms due to policy violations, implementing warnings to shield users from associated websites. IAB Europe suspended Discover-Tech from its global vendor list for violating terms, reinforcing the consequences faced by companies engaging in illicit practices.