Scammers and cybercriminals are always looking for a way to get a leg up on people, crafting ways to take your money and identity, and ultimately annoy you and everyone else senselessly. There are always new scams and always new methods worth hearing about, frustratingly almost weekly at this point, and being alert is now just something we all probably do.
But a new type of malware could make life the security landscape more complex, because it can infect without you doing anything more than simply browsing a website.
The Citizen Lab team at the University of Toronto in Canada has uncovered a rather nasty type of malware sitting inside Internet advertisements loading on phones, tablets, and computers, and it comes with a payload that can install simply by having the ad appear.
The specific type of advertisement has been called “AdFection” by the team of researchers, and is effectively a form of spyware that so far has been used to target journalists and employees at computer hardware companies, not to mention organisations including NATO.
The ads themselves were shown on almost over 120,000 websites and across apps found on Android and iOS over a four month period, collecting data and installing spyware on targets. It even made its way into some apps you may have used, including Yahoo Mail, MX Player on Android, and language-learning app Duolingo, and while Android clearly had more, iOS saw some of the ads, as well.
Curiously, while the list of ad impressions was a global thing, Australia carved out a special mention in CitizenLab’s report, noting that the spyware ads made its way to networks connected with universities and infrastructure, even finding its way to the Australian Nuclear Science and Technology Organisation (ANSTO), as well as reportedly three major media organisations located here, too.
It’s a staggering find, and may just push people to the world of ad-blocking, particularly if this sort of thing becomes the norm.
Sites without ads (such as this one) clearly wouldn’t have served the malware, but with over a hundred thousand websites hit, browsers with ad blocking built-in (such as Brave) might be worth a look-in, or even other browsers where privacy plays a big part (such as Safari on Mac).
