OMM Newsroom
Israeli digital advertising firm “Discover-Tech” used a large commercial ad network to harvest personal data and deliver spyware to targeted devices worldwide, according to an investigation published Thursday by Canadian cyber watchdog “Citizen Lab” and New York-based ad security firm “Confiant”.
The operation turned commercial advertising infrastructure into a system for identifying targets and delivering spyware, with sophisticated technical controls and measures designed to prevent interception, “Confiant” said.
Researchers said the campaign enabled US-blacklisted Israeli spyware company “Candiru”, which has rebranded as “Integrity Labs”, and surveillance vendor “Intelos” to exploit ad inventory on major platforms, including “Google”, “Beeswax” and Russia’s “Yandex”.
“Citizen Lab” described the findings as the first public technical confirmation of mercenary spyware delivered through online advertising without any action from the target. Researchers called the method “AdFection”.
Staff at international news network “Al Jazeera” were among those whose devices were infected through the ads, which operated without visible pop-ups or suspicious links.
Ad system collected data across nearly 200,000 sites and apps
“Discover-Tech” used a system called “Controlium” to turn routine advertising auctions into a surveillance operation. After examining 4 billion bidding records, researchers found that the firm distributed ads across nearly 200,000 websites and mobile apps on Android and iOS in dozens of countries over four months.
“Discover-Tech” served about 10 million ad impressions each day, with each one contributing to an identity graph built from device fingerprints, IP addresses, advertising IDs and, in many cases, publishers’ first-party cookies, “Confiant” said.
Investigators found that the ads routinely collected session cookies, authenticated login tokens and personal identifiers from publisher websites. The data was transferred out even when European Union privacy rules prohibited processing it without consent, the researchers said.
“Citizen Lab” also said an affiliated threat actor, which it called “Dark Cartographer”, used “Discover-Tech” infrastructure to exploit vulnerabilities at mobile telecom providers. The actor matched advertising identities with physical phone numbers to identify mobile subscribers on a large scale.
Palestine was the most heavily targeted territory
Geographic data showed sharp spikes in advertising traffic that researchers said pointed to deliberate intelligence operations rather than ordinary commercial activity. Palestine was the most heavily targeted territory: “Discover-Tech” served nearly 2% of all digital ads there, with its share reaching roughly 10% on April 7. One in every 36 Android ads in the territory came from the firm.
Surveillance traffic also reached sensitive administrative and institutional networks, including the Armenian Prime Minister’s Office, international bodies, judicial agencies, universities and defense organizations.
Researchers detected targeted connections to “Candiru” servers in nine countries. Belgium accounted for 56% of the observed activity, followed by the United Arab Emirates, Saudi Arabia, Bahrain, Mexico, Spain and other countries.
After the joint investigation was disclosed, “Google”, the European advertising association “IAB Europe”, “Beeswax”, “Vungle” and “Eskimi” cut “Discover-Tech” off from their digital advertising systems.
