A new report from Citizen Lab has revealed spyware called AdFection, capable of infecting phones and computers simply by displaying a malicious advertisement, without requiring the victim to click a link or open a file. Researchers describe this as the first confirmation of government-backed spyware attacks delivered through online advertisements and operating in a “zero-click” manner.
According to the report, the technology was developed by Israeli company Discover-Tech, which presents itself as a legitimate advertising company. The system was used to target journalists and employees at Al Jazeera, as well as officials and employees at institutions and organizations including the North Atlantic Treaty Organization, the European Commission, NVIDIA, and Arm.
How did advertisements become a spying channel?
Discover-Tech exploited the real-time bidding system used in targeted advertising, which allows advertisers to compete to display ads to specific users. According to Citizen Lab, this infrastructure was instead used to identify or de-anonymize users and then select specific targets, before embedding malicious code in advertisements that appeared ordinary.
The danger of the method lies in the broad reach of the advertising network. The organization said that advertisements linked to the system were displayed 442 million times on more than 120,000 websites, including BBC and The New York Times, and on applications such as Duolingo, Badoo, and Grindr. The advertisements also appeared on devices used by militaries, governments, critical infrastructure, and national cybersecurity agencies.
Action by Google and unanswered questions
Google was among the advertising platforms targeted by this technology, but it removed Discover-Tech from its global list of suppliers following a joint investigation with Citizen Lab and Confiant. Google said the company was blocked from its platforms for systematically violating its policies.
Researchers also found login records on the Discover-Tech website containing data concerning employees of spyware company Candiru. Discover-Tech and the other entities mentioned in the scheme had not commented by the time the article was published.
Why does this matter?
The disclosure shows that the digital advertising model, which reaches users through a vast number of websites and applications, can become an infection channel that requires no obvious action from the victim. This expands the scope of the risks compared with attacks that rely on phishing or downloading a file, but it does not establish that every advertisement or advertising platform is exposed in the same way; the report focuses on a specific system and a specific company, while the full details of the investigations have not yet been disclosed.
Citizen Lab researcher Bill Marczak said that what has been uncovered may be “just the tip of the iceberg,” urging people who may be targeted because of their identity or work to disable ad tracking or block advertisements. Questions about the extent to which the technology has spread, the number of devices actually infected, and the parties behind its use remain without complete answers in the available material.