AdFection: Targeted ads turned into a pipeline for zero-click mercenary spyware

Malicious actors can now infect your device with spyware just by showing you an ad.

Citizen Lab has uncovered a sophisticated technique dubbed "AdFection," which leverages targeted online advertisements to deliver zero-click mercenary spyware. Israeli company Discover-Tech is identified as the orchestrator, operating a platform called Controlium that facilitates these attacks. Devices at Al Jazeera were infected with spyware from Candiru, a company rebranded as "Integrity Labs," through malicious ads purchased by Discover-Tech. Discover-Tech's platform enables its partners to de-anonymize, fingerprint, and automatically infect devices upon ad rendering, a zero-click exploit. Analysis of billions of bidding records revealed Discover-Tech's ads appeared on nearly 200,000 websites and apps globally over four months, directing millions of devices to contact Candiru's servers for tracking. Discover-Tech is also linked to other mercenary spyware vendors like Intelos and Bindecy, and its infrastructure is reportedly used by a threat actor called DARK CARTOGRAPHER for mass deanonymization. Despite Discover-Tech's presence on vendor lists from Google and IAB Europe, and its use of major ad networks, actions have been taken to disconnect its access to the digital advertising ecosystem.

The AdFection technique highlights systemic vulnerabilities within the digital advertising ecosystem, which, despite its vast data collection and targeting capabilities, failed to prevent the abuse of its infrastructure for mercenary spyware delivery. Discover-Tech's operation, facilitated by major ad networks and compliant with GDPR consent frameworks, demonstrates how legitimate advertising technology can be repurposed for covert surveillance and espionage. This revelation necessitates a re-evaluation of oversight and security protocols within the online advertising industry to prevent similar exploitation in the future.

The exposure of AdFection and Discover-Tech's role has prompted immediate industry responses, with Google, IAB Europe, Beeswax, Vungle, and Eskimi disconnecting the company's access to their platforms. This action signals a move towards greater accountability and tighter controls on ad tech vendors involved in potentially malicious activities. The ongoing work to mitigate DARK CARTOGRAPHER's deanonymization attacks further underscores the evolving threat landscape at the intersection of advertising technology and mass surveillance, requiring continuous vigilance and adaptation from defenders and regulators.