A New Sophisticated Threat

Security researchers at Citizen Lab have identified a dangerous new spyware variant known as "AdFection." This malicious software stands out because it can compromise mobile devices and computers simply by displaying an advertisement—eliminating the need for the user to interact with or click on any suspicious links or files. According to the report, this marks the first instance of zero-click, state-sponsored spyware being successfully delivered through standard online advertising infrastructure.


Targeting High-Profile Entities

The technology behind this campaign was reportedly created by the Israeli firm Discover-Tech. Investigators found that the tool has been used to surveil journalists, including staff at the Al Jazeera network, as well as personnel from major global organizations such as NATO, the European Commission, NVIDIA, and Arm.


"Discover-Tech has leveraged the advertising ecosystem for years to turn trusted websites and popular apps into a zero-click spyware delivery platform," stated Bill Marczak, a senior researcher at Citizen Lab.

The report characterizes Discover-Tech as a firm that masks its activities as legitimate advertising services while acting as a conduit between ad networks and the mercenary spyware market.


The Role of Real-Time Bidding

The spyware exploits the automated real-time bidding (RTB) system used by global ad networks. By participating in these auctions, the attackers were able to:

  • Profile and de-anonymize specific internet users.
  • Inject malicious code into ads that appeared benign to the end-user.
  • Deliver the payload without any user interaction.

In response to these findings, Google took immediate action, removing Discover-Tech from its ad platforms due to systematic policy violations discovered during a joint probe with Citizen Lab and Confiant.


Scope of the Campaign

The reach of this operation was extensive. Discover-Tech allegedly served over 442 million ads across more than 120,000 websites and various mobile applications, including platforms like Duolingo, Badoo, and Grindr. The ads appeared on devices linked to governments, military branches, and national cyber agencies.


Marczak warned that these findings are likely only a small part of a larger problem. To mitigate risk, experts recommend that individuals who may be targeted due to their professional roles should consider disabling ad tracking or utilizing ad-blocking software. As of now, Discover-Tech and other involved parties have not provided comments on the report.