Researchers uncovered a covert campaign called “AdFection” in which targeted online ads delivered zero-click mercenary spyware to phones and other devices without any user interaction. An Israeli ad firm called Discover-Tech operated an ad platform, Controlium, that could de-anonymize and fingerprint visitors and then steer devices to infrastructure tied to the spyware vendor Candiru. Analysis of network logs from a news outlet shows 45 devices were targeted in 2024-25, and ad-bidding records indicate Discover-Tech-linked impressions ran across more than 70,000 mobile apps and 120,000 websites, directing millions of devices to Candiru-related servers. The delivery method merges the longstanding privacy abuses of programmatic real-time bidding with rare zero-click exploits, allowing operators to compromise specific individuals simply by showing tailored ad content.
The campaign exposes a serious gap in defenses: ordinary users cannot reliably detect or block such infections except by aggressively blocking ads, and home or mobile connections lack the monitoring that revealed these attacks. Industry reactions included Google removing Discover-Tech from its ad platforms, IAB Europe suspending the firm from its global vendor list, and platform providers ejecting the company, but investigators warn that only architectural changes or rigorous vendor vetting will stop similar abuse. The attacks also touched sensitive networks - NATO, UN, government bodies and critical infrastructure - underscoring the widespread risk to privacy, national security, and the open web.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Canada's proposed surveillance law aims to mandate backdoors in encryption, prompting companies like Signal, Apple, and Meta to consider leaving the country. Governments worldwide continue to push for legislation that threatens encryption's security, despite experts warning such flaws are impossible to implement safely. (wired.com)
A freelance investigator infiltrated the highest ranks of American militias, including doctors and attorneys, without informing authorities or family. He collected and shared a trove of encrypted documents revealing internal militia activities and plans. (propublica.org)
WordPress sites on a server reported emails as sent, but none of the messages actually arrived in recipients' inboxes, exposing a false success indicator. The root cause was the server's mail program accepting messages but failing to deliver them, emphasizing the need for real-world testing instead of relying solely on status codes and logs. (iampneuma.com)
Meta removed the No Kings Instagram account during a protest day. The action appears to be influenced by government pressure, raising concerns about social media censorship. (meidasnews.com)
Strikes on Yandex data centers in Russia led to an 84% decline in bot activity, especially on Facebook and Telegram. The attacks caused the shutdown of key facilities, significantly reducing the dissemination of inauthentic content. (cpd.gov.ua)
A retired Penn professor was arrested for blocking an Uber Eats robot during a protest. The incident highlights tensions over sidewalk space and delivery robot operations. (phillyvoice.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.