The Citizen Lab published a report, Exposing AdFection, saying an Israel-based company called Discover-Tech weaponised online advertising to install spyware by showing view-only ads that ran code and created back doors. The campaign profiled and targeted millions of devices and researchers verified infections of devices belonging to Al Jazeera and systems on networks belonging to the Australian Nuclear Science and Technology Organisation and other Australian government and critical infrastructure organisations. Discover-Tech reportedly bid in normal ad auctions to place seemingly benign ads on sites and apps including Duolingo, the BBC and the New York Times, then served ads containing code that could silently install zero-click mercenary spyware. The Citizen Lab said one downstream spyware firm with ties to the campaign is Candiru, which has been placed under US export controls for malicious cyber activity. ANSTO said it had not identified any impact to its systems from the techniques described. Deakin University associate professor Diarmaid Harkin called the case novel and said it shows the need for greater oversight of the online advertising industry and its use as an attack surface.
