Citizen Lab首次公开确认了一项通过定向广告实施的零点击雇佣间谍软件攻击，代号为AdFection1。以色列公司Discover-Tech运营虚假广告平台Controlium，充当间谍软件厂商与广告生态之间的中介，用于向特定目标投放Candiru间谍软件1。研究人员分析了约40亿条广告竞价记录，发现Discover-Tech的广告在161个国家的近200000个网站和应用中展示，其中包括美国国务院、NATO、欧盟机构等敏感政府网络1。
至少45台半岛电视台内部设备在2024年至2025年间通过Discover-Tech广告遭受Candiru零点击攻击1。Controlium平台允许客户利用移动广告ID、浏览器ID或IP地址针对单个用户投放恶意代码1。分析期间内（2026年3月至6月），MyDSP竞价平台进行了37.7亿次竞价，其中4.41亿次获胜（占11.7%），约76.7%的流量来自移动应用1。
Discover-Tech的CEO为Dekel Boni，董事Eric Banoun曾是以色列网络间谍先驱，与Intellexa间谍集团有关联1。该公司的一个无认证API端点在128天内暴露了来自120个不同用户名的登录日志，其中包括来自Candiru、Bindecy和Intelos的人员1。2026年10月初，Google和IAB Europe从认证供应商名单中删除了Discover-Tech，Google同时终止了其对广告交易平台的访问权1。Beeswax、Vungle和Eskim等平台已采取措施阻止Discover-Tech的账户和域名1。
Citizen Lab has publicly confirmed a sophisticated attack campaign delivering zero-click spyware through targeted advertisements, dubbed AdFection.1 The operation centers on Discover-Tech, an Israeli company that operated a fake advertising platform called Controlium to serve as an intermediary between spyware vendors and the digital advertising ecosystem, facilitating the deployment of Candiru spyware against specific targets.1 Researchers analyzed approximately 4 billion advertising bid records and discovered that Discover-Tech's ads appeared across nearly 200,000 websites and applications in 161 countries, including sensitive networks belonging to the U.S. State Department, NATO, and European Union institutions.1
At least 45 internal devices at Al Jazeera fell victim to Candiru zero-click attacks via Discover-Tech advertisements during 2024 and 2025.1 The Controlium platform allowed customers to deploy malicious code against individual users by leveraging mobile advertising IDs, browser IDs, or IP addresses.1 During the analysis period from March to June 2026, the MyDSP bidding platform submitted 3.77 billion bids and won 441 million auctions, representing an 11.7 percent success rate, with approximately 76.7 percent originating from mobile applications.1
Discover-Tech's leadership includes CEO Dekel Boni and board member Eric Banoun, a former Israeli cyber espionage pioneer with connections to the Intellexa spyware group.1 An unauthenticated API endpoint exposed login logs for 120 different usernames over 128 days, including personnel from Candiru, Bindecy, and Intelos.1 By early October 2026, Google and IAB Europe removed Discover-Tech from their certified vendor lists, with Google terminating the company's access to its advertising exchange platform.1 Technology companies including Beeswax, Vungle, and Eskim have implemented measures to block Discover-Tech accounts and domains.1 Discover-Tech advertisements had previously appeared on networks operated by NATO, the United Nations, the European Parliament, the European Commission, and the U.S. Department of Defense.1
评论
还没有评论，欢迎留下第一条。