Zero-Click Spyware Delivered via Targeted Ads: AdFection

Your online ad activity is now a vector for zero-click spyware, capable of infecting devices without any user interaction.

Citizen Lab has revealed a technique called AdFection, enabling the zero-click delivery of mercenary spyware through targeted online advertisements. Discover-Tech, an Israeli company, operates a platform named Controlium that facilitates this process, allowing its partners to de-anonymize and infect devices automatically upon ad rendering. This method was used to infect devices at Al Jazeera with Candiru's spyware. Discover-Tech's ads reached nearly 200,000 websites and apps globally, with some ads covertly directing devices to Candiru's servers for tracking. The company is also linked to other surveillance vendors like Intelos and Bindecy. Further analysis indicates Discover-Tech's infrastructure is used by a threat actor called DARK CARTOGRAPHER to link device advertising IDs with phone numbers, enabling mass deanonymization. Despite being certified by Google and IAB Europe, and serving ads through major networks like Google and Yandex, Discover-Tech has been disconnected from the digital advertising ecosystem by several vendors following Citizen Lab's disclosure. Google, IAB Europe, Beeswax, Vungle (Liftoff), and Eskimi have taken action, while others did not respond.

The exploitation of the digital advertising ecosystem for zero-click spyware delivery, as detailed with AdFection, signifies a critical vulnerability in how online ads are served and data is exchanged. Discover-Tech's ability to leverage real-time bidding auctions and GDPR consent frameworks to deploy sophisticated spyware highlights a systemic failure in ad tech's security and privacy safeguards. This also reveals how legitimate advertising infrastructure can be co-opted by mercenary surveillance vendors to facilitate mass tracking and targeted espionage, blurring the lines between commercial advertising and state-sponsored surveillance.

The successful intervention by multiple ad vendors like Google and IAB Europe in disconnecting Discover-Tech points to a growing awareness and reactive capability within the industry, but the broader structural flaws remain. The ongoing work to mitigate DARK CARTOGRAPHER's mass deanonymization attack suggests that the advertising ecosystem's inherent data collection practices continue to be exploited for widespread privacy invasion. Future attacks may evolve, requiring continuous vigilance and potential regulatory intervention to secure the advertising pipeline against such misuse.