AdFection Abuses Targeted Ads to Deliver Zero-Click Spyware, Prompting Platform Bans

Citizen Lab and Confiant reported that AdFection abused targeted online advertising to deliver zero-click mercenary spyware, linking advertisements from Israeli company Discover-Tech to spyware vendor Candiru. Citizen Lab attributed the Controlium advertising platform to Discover-Tech and linked its activity to DARK CARTOGRAPHER, Intelos and Bindecy. When a malicious ad loads, it contacts an attacker-controlled server that can fingerprint the device and selectively deliver malicious JavaScript without user interaction. Ads reportedly reached millions of people across dozens of countries, including networks associated with government, national security, energy, semiconductor and major technology organizations; ad impressions do not establish that devices were infected.

Google, IAB Europe, Beeswax, Vungle (Liftoff) and Eskimi removed Discover-Tech’s access to their advertising ecosystems. Google said it banned the company during the investigation and continuously blocked malicious ads while dismantling the network. U.S. Senators Ron Wyden and Cory Booker renewed calls for stronger privacy protections and advertising-industry reform, particularly to protect government devices, while industry representatives disputed broader criticism of their security practices. Citizen Lab recommended stronger vendor vetting, threat-information sharing, regulatory investigations and sanctions against spyware vendors and their enablers.