Millions exposed to spyware operation through online ads, researchers say

EU and NATO websites displayed online ads linked to Israeli hacking software.

Listen

AI generated Text-to-speech

An investigation by the University of Toronto's Citizen Lab and cybersecurity firm Confiant Threat Intelligence laid bare an ad-based infection technique developed by an Israeli company that researchers named "AdFection." The hacks weaponized legitimate online ad systems for espionage purposes, allowing spyware manufacturers to connect to millions of devices and identify, track and target victims.

“Plugging into the online ads ecosystem provides the mercenary spyware industry a stealthy delivery system,” said Bill Marczak, senior researcher at The Citizen Lab. He said the findings were “surely just the tip of the iceberg” of how online ads are abused for espionage.

Researchers discovered critical details of the hacking tools by analyzing devices belonging to journalists and staff at the Al Jazeera media network, finding that 45 devices of journalists and staff were targeted and some infected with Israeli-made spyware known as Candiru.

Discover-Tech and Integrity Labs did not immediately respond to a request for comment.

The scale is striking: An analysis of four billion advertising records found that Discover-Tech's ads appeared across nearly 200,000 websites and mobile apps in dozens of countries over four months. Among the websites that featured the ads were institutional sites of NATO, the United Nations, the European Parliament, European Commission and Council of the EU.

Citizen Lab, based in Toronto, is a globally recognized research group that previously uncovered spyware scandals targeting Catalan political figures, a member of the European Parliament and the inner circle of murdered Saudi journalist Jamal Khashoggi.

The findings triggered calls for further investigation on Thursday. “The possibility that EU institutions have been exposed should set off alarm bells across Brussels," said Hannah Neumann, a German European Parliament lawmaker of the Greens group. Neumann herself was the victim of a cyber-espionage operation by an Iranian hacking group.

"Europe cannot claim to defend democracy while leaving its own democratic institutions vulnerable to spyware,” Neumann said.

Related Tags

Communications

Conflict

Cyber Espionage

Cyber warfare

Cybersecurity and Data Protection

Data protection

Espionage

Intelligence

Law enforcement

Malware

Media

Military

Platforms

Privacy

Rule of Law

Spyware

Surveillance

Telecoms

War

Related Countries

Israel

Related Organizations

European Parliament

Google

NATO

Our readers read next

Starlink restrictions in Ukraine a ‘planned operation’, Zelenskyy says

15 HRS ago

3 mins read

Police, demonstrators clash on sidelines of mass French protests

16 HRS ago

4 mins read

EU faces growing pressure to plug Ukraine’s Starlink gap

Oct 16

3 mins read

In Europe’s tech capital, Irish labor unions are booming amid AI-driven layoffs

Oct 16

8 mins read

More from Antoaneta Roussi

Why Ukrainian strikes on data centers are a real problem for Russia — and beyond

Servers have become a target of war. As well as disrupting daily life, the strikes are raising questions of international law.

The former head of Germany’s foreign intelligence service built a lucrative second career trading on his security expertise. Now prosecutors accuse him of profiting from secrets belonging to the state.

The EU police agency will have to contend with both cybercriminals and privacy activists.

Authorities allege the pair collected information on NATO forces, military aircraft and Latvia’s support for Ukraine.