Citizen Lab has documented a new form of government-backed spyware called AdFection that infects phones and computers through ordinary online advertising, with no link or file needed from the victim. The report describes the first confirmed case of zero-click state-linked spyware delivered through ad networks, and Google has already removed the vendor behind it from its ad platforms.<\/p>\n
Targeted ads already reach nearly every internet user, which is what made them useful for malware distribution. The system runs on automated real-time bidding, where advertisers compete in auctions to show ads to specific users. Citizen Lab found that one vendor used that same pipeline to profile and de-anonymize users, then sent them malicious code hidden inside ads that looked normal.<\/p>\n
According to the report, the technology was built by an Israeli firm, Discover-Tech, which presents itself as a legitimate advertising company. Researchers say Discover-Tech acted as a bridge between mainstream ad vendors and the mercenary spyware market, turning trusted websites and popular apps into a delivery platform for zero-click infections.<\/p>\n
Citizen Lab identified journalists and personnel at the Al Jazeera news network among the targets. Officials and employees at NATO, the European Commission, NVIDIA and Arm were also on the target list. The ads reached devices used by militaries, governments, critical infrastructure operators and national cyber agencies.<\/p>\n
Discover-Tech reportedly displayed 442 million ads across more than 120,000 websites and apps. Named properties in the report include the BBC and The New York Times on the web side, and mobile apps such as Duolingo, Badoo and Grindr. Login records uncovered on Discover-Tech’s own site included credentials belonging to employees of another spyware vendor, Candiru.<\/p>\n
Google was one of the major ad platforms exploited by the operation. After a joint investigation with Citizen Lab and the ad security firm Confiant, Google suspended Discover-Tech from its global vendor list for systematically violating its policies.<\/p>\n
Programmatic advertising runs across publishers worldwide, often without the publisher or user seeing what is actually served. That reach, combined with real-time user profiling, gives an attacker a way to pick a target, match a device, and push code through a channel that most security tools treat as ordinary traffic.<\/p>\n
Citizen Lab researchers framed the finding as the visible part of a much larger problem. The recommendation for people who may be targeted by their role or employer is straightforward: disable ad tracking on devices, or block ads altogether.<\/p>\n
AdFection is the name Citizen Lab gave to a new class of zero-click government-backed spyware delivered through online advertising networks. It can infect a device when an ad is simply displayed, with no click required.<\/p>\n
Citizen Lab attributes the ad-infiltrating technology to Discover-Tech, an Israeli company that presents itself as a legitimate advertising firm.<\/p>\n
Following a joint investigation with Citizen Lab and Confiant, Google blocked Discover-Tech from its ad platforms for systematically violating its policies.<\/p>\n