Two research teams have published parallel investigations into spyware delivered through the online advertising supply chain. The digital forensic research institute the Citizen Lab and the ad tech-focused cybersecurity company Confiant documented how the Israel-based purported advertising firm Discover-Tech used digital ads to infect devices used by at least 45 journalists at Al Jazeera.
What happened
The reporting describes infections that required no interaction from the person holding the device. Confiant separately analyzed targeting data and found evidence suggesting that the malicious ads were rendered on networks in the U.S. Department of Defense, Estonia's Information System Authority (RIA), the International Atomic Energy Agency (IAEA) and the International Criminal Court.
The scale described goes well beyond the named targets. The ads covertly directed millions of devices to contact Candiru's servers, likely for large-scale tracking and reconnaissance, the report said.
How it was done
The delivery path was ordinary ad placement. The Citizen Lab studied four billion Discover-Tech ad placement records and found that over just four months the corrupted ads were displayed on Android/iOS apps and nearly 200,000 unique websites, according to the research.
The Citizen Lab also describes the capability on the other end of the chain. The Controlium software allows spyware firms to record calls, turn on microphones and siphon off messages and emails, the Citizen Lab said.
The ads covertly directed millions of devices to contact Candiru's servers, likely for large-scale tracking and reconnaissance.
What to check
If your staff browse the web or use mobile apps on managed devices, the ad supply chain is part of your exposure.
Confirm high-risk phones report telemetry you can query
Open your device management console and filter the inventory for staff handling journalism, legal casework or executive communications. Check enrolment status, operating system version and last check-in time. Devices that are unenrolled, or that have not checked in for weeks, are a bad result.
Prove you can search historical outbound connections
Run a test query in your SIEM for a known domain across DNS, proxy and firewall logs going back ninety days or more. Include the egress paths used by mobile and guest networks. If the query returns nothing because those logs are not collected or not retained, you cannot answer a future indicator list.
Inventory third-party ad and tracking code on your own properties
Load each public site and app view with the browser network tab open, or crawl them, and list every external script and beacon domain. Compare that list against the tags your team approved. Any domain with no named owner should be removed or justified.
Reduce ad and script execution on sensitive devices
Apply DNS filtering and enterprise browser policy to block ad and tracker domains on devices used for sensitive work, and review the hardened modes your mobile platform offers. Verify enforcement from a test device rather than from the policy page. Settings that show as applied but do not block anything are the failure case.
Rehearse the mobile forensics path
Name who can collect a device log bundle, such as an iOS sysdiagnose or an Android bug report, and where those artefacts are stored. Walk through one collection end to end, including legal hold and chain of custody. A path that depends on a single unavailable person is not a path.
Extend vendor review to advertising intermediaries
Pull the list of ad networks, exchanges and measurement partners that can place code on your properties, and check which contracts cover subcontracted supply. Ask who can inject new creative without your review. An empty or unmaintained list means nobody owns that risk.