Zero-Click Spyware Delivered via Targeted Ads: AdFection

Researchers at Citizen Lab discovered a new form of zero-click spyware that is delivered through targeted ads. The spyware, called AdFection, was found on a website used by a activist group in Uganda. The website, which was not named, used a technique called 'cross-site scripting' to inject the spyware into the browsers of visitors. The spyware was designed to steal sensitive information such as phone numbers, emails, and physical addresses from the devices of affected users. The researchers were able to identify 10 different variants of the spyware, all of which were designed to target specific individuals or groups. The spyware was likely distributed through a network of compromised websites, and the researchers were able to track its spread to at least 10 different countries. The researchers noted that the use of targeted ads to deliver spyware is a new and concerning trend, as it allows attackers to evade traditional security measures.