"God-like capabilities": An ad appearing on your phone can now spy on you, researchers say

Findings

Citizen Lab researchers at the University of Toronto say they identified “zero-click” spyware that can infect a device when a targeted online ad appears, without the user clicking or interacting with it. Once a phone is compromised, it could be used to record conversations, track someone’s location and movements, or identify their contacts.

Citizen Lab says 45 devices associated with the Al Jazeera news network were targeted. Researchers also found evidence that ads profiled people connected to sensitive organizations, including nuclear research facilities in Australia and government offices in Armenia, Italy, Czechia, and Israel. They could not determine who was using the spyware.

Companies and responses

The report alleges that Israel-based Discover Tech, which presents itself as an advertising company, acts as a front for ad-based espionage. It also alleges that Candiru, also known as Integrity Labs, makes the spyware. Reuters reported that the U.S. had previously blacklisted both companies.

Discover Tech did not respond to requests for comment. Reuters and Global News said they were unable to reach Candiru.

Implications

Citizen Lab director Ron Deibert said ad blockers can help, but argued that the targeted-advertising ecosystem is vulnerable to abuse and that meaningful change requires government action.

Global News said it received no response by its deadline from Digital Innovation Minister Evan Solomon.

Presenters and contributors

• Nathaniel Dove: Reporter
• Ron Deibert: Citizen Lab director and report co-author