Citizen Lab said on 15 October that an Israeli firm, Discover-Tech, used ordinary online ads to deliver Candiru spyware to devices without a single click. Ten days earlier, Denmark confirmed that the names, addresses and ID numbers of about 8.8 million people had been taken from its Central Register of Persons.
Google and IAB Europe removed Discover-Tech from their vendor lists in early October, and Danish police are investigating the breach.
Ads Carried the Spyware
Citizen Lab found that Discover-Tech presents itself as an ordinary advertising firm but works as a pipeline for spyware makers, including Candiru. Each ad carried hidden code that sent the device’s advertising ID and internet address to a Discover-Tech server, and infected devices then contacted a Candiru server that screened them. Citizen Lab says Candiru has been renamed Integrity Labs.
CBC reported that the ads ran on more than 120,000 websites and in 75,000 apps over four months, including the sites of the BBC, CBC and the New York Times. At least 45 devices at Al Jazeera were targeted in zero-click attacks, which need no click or other action from the user. Publishers sold ad space to an exchange and trusted whoever bought it, and that trust was the way in.
A Small Vendor Held the Register’s Keys
Denmark’s breach began at Pays ApS, a two-employee IT company in Odense with authorised access to the Central Register of Persons. A person claiming responsibility told Politiken that at least three Pays accounts, including an administrator account, used the password 123456, though officials have not confirmed the claim. TV 2 reported that the attacker got in on 10 September and ran about 14 million automated searches by 20 September.
The register holds about 11 million records, and the attacker reached the names, addresses and ID numbers of about 8.8 million people, living and dead. Nobody noticed for three weeks, and a ministry employee found the breach on 2 October only by spotting an unusually high invoice for Pays’ searches.
Denmark’s public security agency now says a CPR number can no longer be trusted alone to prove who someone is.
Trusted Access Needs Watching
Both attacks used access that someone had granted and nobody was checking. Ad exchanges let an ordinary-looking buyer put code into an ad, and the register let a two-employee firm search at huge volume, with a password reportedly as weak as 123456. Neither needed a headline-grabbing exploit, only a trusted channel.
Google and IAB Europe cut Discover-Tech off after Citizen Lab shared its findings, and Denmark closed the Pays access once the invoice raised an alarm. A strong password, multi-factor sign-in and a cap on what one account can retrieve would have blocked or limited the Danish theft.
Alerts on search volume should have caught it in days rather than weeks. A reader cannot dodge a zero-click ad by avoiding links, so platforms, suppliers and governments must watch their intermediaries before attackers do.
Keep up with Daily Euro Times for more updates
Read also:
EU Cybersecurity Rules Create a New Kind of Cyber Slop
Saudi Arabia Pays Cultural Businesses to Adopt AI
