Targeted ads delivered 0-click exploits to install mercenary malware
摘要
多伦多大学Citizen Lab发现，有雇佣黑客通过定向广告投放零点击漏洞，在目标仅加载网页或打开应用时，便在其iOS和Android设备上安装复杂间谍软件。该行动被命名为AdFection，据信是首次确认通过定向广告传播零点击雇佣间谍软件。2024至2025年间，卡塔尔半岛电视台有45台设备被感染。研究人员警告，全球新闻机构可能正被此类新威胁主动针对，这一
Researchers say that mercenary hackers laced ads with zero-click exploits that installed sophisticated malware on the devices of targeted individuals when they did nothing other than load a website or open an installed app.
The finding, published Thursday by the University of Toronto’s Citizen Lab, said the incident is likely to be the first confirmation of zero-click mercenary spyware delivered through targeted ads. The attacks, which worked on iOS and Android devices, are particularly pernicious because they work without requiring any interaction from the target and are invisible unless users run special forensic hardware or software. Citizen Lab said it confirmed that AdFection, as it named the campaign, infected 45 devices at international media organization Al Jazeera in 2024 and 2025.
A clear warning signal
“This investigation should … serve as a clear warning signal to news organizations around the world that they may be being actively targeted via this new threat,” Citizen Lab researchers wrote. “This targeting may happen both in newsrooms and to individual journalists, editors, and other staff members.” Their report went on to say: “The distribution of spyware via targeted ads represents a security risk not only for potential victims but also for states and civil society at large.”
转载信息
评论 (0)
暂无评论，来留下第一条评论吧