On Thursday, researchers from The Citizen Lab at the University of Toronto revealed a worst-case scenario found in the wild: spyware silently infecting targets as they browse past ads in their daily digital lives.

Dubbing the attacks “AdFection,” the researchers documented a campaign in which an Israeli-registered advertising firm allegedly connected to the servers linked to a spyware company and infected dozens of devices with its invasive malware. Citizen Lab believes this to be the first detailed technical evidence made publicly available of sophisticated spyware infecting devices via digital ads.

Zero-click hacks are a holy grail for attackers and catastrophic for victims, because they can automatically install malware on devices without requiring any interaction or missteps from the target. When sophisticated hackers have deployed rare zero-click attacks in recent years, they have often exploited vulnerabilities in mobile messaging and communication apps to infect victims. But attackers have also exploited the sprawling infrastructure of the online ad ecosystem to distribute malware, sometimes with little or no interaction needed from victims. Evidence of the zero-click spyware campaign that Citizen Lab’s researchers uncovered shows the two threats merging, underscoring the extent and urgency of the risk.

“AdFection allows operators to automatically hack specific individuals with mercenary spyware as they use apps or browse the internet,” says Bill Marczak, a senior researcher at Citizen Lab. “Someone who gets hacked like this would not see anything amiss. In fact, they might not even see any ad at all.”

The situation is so concerning, he notes, because there isn’t much that people can do to protect themselves from zero-click ad attacks other than blocking ads as thoroughly as possible on all websites and platforms—a fact that intelligence agencies like the NSA and CIA seem to know all too well.

Source link