{"id":10020,"date":"2026-10-16T01:02:34","date_gmt":"2026-10-16T01:02:34","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10020"},"modified":"2026-10-16T01:02:34","modified_gmt":"2026-10-16T01:02:34","slug":"no-click-required-how-the-ad-industry-became-a-pipeline-for-mercenary-spyware","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10020","title":{"rendered":"No click required: How the ad industry became a pipeline for mercenary spyware"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

That ad you just scrolled past on your phone but barely spared a look or click? It could be tracking your movements and collecting your data, without you having to do a thing.<\/p>\n

This \u201czero-click mercenary spyware,\u201d dubbed \u201cAdFection,\u201d is increasingly exploiting a sprawling online advertising ecosystem ripe for abuse, according to researchers at The Citizen Lab<\/a>. One top actor in the space, Discover-Tech, runs the Controlium <\/em>platform that allows cyber criminals to \u201cprecisely profile and de-anonymize\u201d millions of users, fingerprint them, and automatically infect their devices when an ad is displayed.<\/p>\n

Troublingly, Discover-Tech is successfully masquerading as a legitimate ad company across the online ad sales environment, the researchers said, listed as a \u201ccertified\u201d and \u201capproved\u201d vendor by the likes of Google and IAB Europe.<\/p>\n

Over a four-month period, the company\u2019s ads were shown on nearly 200,000 unique websites and in Android\/iOS apps in dozens of countries. Furthermore, its ads have been presented through major networks like Google, Yandex, and Beeswax, and it even exploited the European General Data Protection Regulation (GDPR) consent frameworks to target victims in the EU.<\/p>\n

The Citizen Lab researchers disclosed their findings to Google, IAB Europe, Beeswax, Vungle (Liftoff), and Eskimi, all of whom took action to disconnect Discover-Tech\u2019s access to the digital advertising ecosystem.<\/p>\n

\u201cDiscover-Tech\u2019s mass abuse, privacy invasion, and facilitation for mercenary spyware attacks<\/a> illustrates structural flaws with the online advertising system, which failed to detect or prevent the abuse,\u201d the researchers warned.<\/p>\n

How AdFection exploits a largely unprotected system<\/h2>\n

The online ad market operates largely via real-time bidding (RTB), auctions hosted by ad exchanges. Run by companies like Google, these take place \u201chundreds of billions\u201d times a day, the researchers explained. When an ad box pops up on an app or website on a user\u2019s device, it immediately triggers a bid request; advertisers then submit their offers, and the exchange grants a winner the ability to push their ad to the user within split seconds. These ads can contain images, video, and, most importantly to cybercriminals, code.<\/p>\n

Demand-side platforms (DSPs) and supply-side platforms (SSPs) act as intermediaries in the process, and data about specific users and devices is shared across the exchanges so advertisers can decide whether they want to show specific ads to a specific individual, based on device identifiers and characteristics such as a user\u2019s precise location, cookie ID, mobile ad ID, or IP address.<\/p>\n

\u201cThe auction system is designed to enable targeting single individuals,\u201d the researchers explained. \u201cThe totality of information gleaned from ad auctions is quite valuable.\u201d Companies with access to auction data can track users without their knowledge, across cellular, Wi-Fi, and virtual private networks (VPNs).<\/p>\n

Discover-Tech has effectively infiltrated and connected the spyware industry to this online ecosystem, which includes infamous Israeli mercenary spyware vendor Candiru. Its partners can deliver ads to \u201cmass-profile unwitting phone users,\u201d and silently infect the devices of select targets, according to the researchers.<\/p>\n

When Discover-Tech wins a bid, one of its ads is pushed to a website or app that is open on a user\u2019s device. Sometimes this is seen by the user; other times is merely renders in the background.<\/p>\n

Many of these ads have been shown to devices on national security-sensitive networks, in security organizations including NATO, networks associated with critical infrastructure, and media organizations around the world. Using AdFection, Candiru\u2019s spyware infected devices at international news network Al Jazeera.<\/p>\n

The researchers emphasized that a Discover-Tech ad impression does not mean that a device has been infected with spyware. However, the fact that the company has been able to bid on and show ads across sprawling ad networks highlights a \u201csystemic risk\u201d warranting \u201curgent investigation.\u201d<\/p>\n

Lack of vetting<\/h2>\n

Discover-Tech\u2019s ads carried no exploit at all, noted Frank Dickson<\/a> of Dickson Research. \u201cThe ad was clean; that is the frightening part. Nobody clicked anything.\u201d<\/p>\n

Instead, each ad called home with the device\u2019s advertising ID and IP address. In almost every case, the server sent back nothing, Dickson emphasized; only chosen targets received malicious code.<\/p>\n

\u201cThird-party verification scanners saw a harmless banner, because for nearly every viewer, it was one,\u201d he said. This is exactly how tags slipped past verification.<\/p>\n

Also alarming is the reach: Discover-Tech\u2019s ads displayed in 75,373 apps and 120,768 websites over the course of four months, and had impressions on networks belonging to NATO, Intel, Microsoft, and Apple. While the report emphasizes that an impression is not an infection, the company\u2019s targeting clearly reached enterprise networks, Dickson said.<\/p>\n

Just as troublingly is the badge: Discover-Tech was listed as a certified or approved vendor for years. The report said that vetting often amounted to self-attestation, a box checked on a form. \u201cA certification is only as good as the vetting behind it,\u201d Dickson said.<\/p>\n

Steps enterprises should take now<\/h2>\n

On managed browsers, ad blockers are necessary, but they\u2019re not wholly sufficient, Dickson said. Many Discover-Tech bids were for ads inside mobile apps, typically overlooked by browser extensions. But clearly, desktops are at play too; Candiru targeted Al Jazeera\u2019s Windows software.<\/p>\n

Dickson advised enterprises to:<\/p>\n

Push a vetted ad-blocking extension to managed browsers through policy rather than leaving it to users to install it.<\/p>\n

Favor browsers with built-in tracking protection.<\/p>\n

Block ad and tracking domains at the DNS or secure web gateway layer; this reaches in-app ads on managed phones.<\/p>\n

Disable advertising identifiers on corporate mobile devices through mobile device management (MDM) and restrict ad-supported consumer apps on devices holding sensitive data.<\/p>\n

Turn on Apple\u2019s Lockdown Mode for high-risk executives, journalists, and any users traveling to sensitive locations.<\/p>\n

Keep browsers and operating systems patched \u201cThe ad is only the delivery truck; the exploit still needs a flaw,\u201d he pointed out.<\/p>\n

Watch traffic tied to ad impressions for odd follow-on requests.<\/p>\n

Finally, search domain name system (DNS) and proxy logs for the domains published in the report.<\/p>\n

The advertising ID in particular deserves a hard look, Dickson pointed out. The Citizen Lab report says that blocking advertising identifiers alone would have stopped this attack method.<\/p>\n

Troublingly, he noted, many enterprises spend fortunes managing their users\u2019 identities, then let corporate phones hand that persistent identifier to anonymous auctions that run hundreds of billions of times a day.<\/p>\n

\u201cEvery ad is someone else\u2019s code running on your device,\u201d Dickson said. \u201cTreat the ad network like any other untrusted vendor.\u201d<\/p>\n

\n<\/p><\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

That ad you just scrolled past on your phone but barely spared a look or click? It could be tracking your movements and collecting your data, without you having to do a thing. This \u201czero-click mercenary spyware,\u201d dubbed \u201cAdFection,\u201d is increasingly exploiting a sprawling online advertising ecosystem ripe for abuse, according to researchers at The […]<\/p>\n","protected":false},"author":0,"featured_media":10021,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10020","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10020"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10020"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10020\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10021"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10020"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10020"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10020"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}