Citizen Lab reveals AdFection spyware campaign via targeted ads
Researchers say mercenary spyware is infecting devices through targeted advertising without user interaction, raising surveillance concerns.
Key points
- Citizen Lab identifies AdFection as a zero-click spyware delivery method using targeted ads.
- Discover-Tech facilitates mercenary spyware partners, including Candiru, through ad networks.
- Ads have appeared on sensitive networks including the U.S. Department of Defense and NATO.
The Citizen Lab at the University of Toronto announced on Thursday that it has identified a new mercenary spyware campaign called AdFection. The operation delivers zero-click infections to victims’ devices through targeted online advertising, requiring no interaction from the user to compromise the system.
According to the researchers, the Israeli firm Discover-Tech poses as a legitimate advertising agency while acting as a facilitator for mercenary spyware partners. The investigation found that Discover-Tech covertly directs millions of devices to contact servers operated by Candiru, a known spyware vendor, through these deceptive advertisements.
Operational Context and Industry Implications
The Citizen Lab concluded that the likely goal of this campaign is large-scale tracking and surveillance. The researchers stated that major industry players like Google have inadvertently enabled this activity. Wolfie Cristl, a senior researcher at The Citizen Lab, described the failure of ad vendors to detect the operation for years as disastrous.
Discover-Tech was registered in 2020 and has facilitated mercenary spyware since at least 2024. The activities of a group dubbed DARK CARTOGRAPHER, which involves Discover-Tech and other vendors including an unnamed U.S. intelligence contractor, date back to 2019.
Affected Networks and Regulatory Concerns
Partner investigators at ad security firm Confiant reported that Discover-Tech’s ads have appeared on many sensitive networks worldwide. These include the U.S. Department of Defense, NATO, the International Atomic Energy Agency, and various world cybersecurity agencies. The campaign also led to the infection of devices at the media outlet Al Jazeera.
Jerome Dangu, chief technology officer and co-founder of Confiant, said the adtech industry needs to rethink its approach to surveillance threats. He noted that the industry has optimized against cybercriminals seeking profit but not against actors seeking surveillance capabilities.
What should you do?
The researchers urged regulators to investigate Discover-Tech and levy sanctions. They emphasized that the digital advertising industry has serious responsibilities regarding the data it collects and how that data might be abused for surveillance purposes.
What to do and how to stay safe: Citizen Lab
- Monitor network traffic for unexpected connections to unknown advertising or tracking servers.
- Review ad-serving configurations to ensure they are not facilitating unauthorized data exfiltration.
- Implement strict network segmentation to limit the reach of potential ad-based compromises.
- Stay alert for vendor disclosures regarding zero-click vulnerabilities in ad-tech infrastructure.
Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is AdFection?
AdFection is a mercenary spyware campaign that delivers zero-click infections through targeted online advertising.
Who is behind the AdFection campaign?
The Israeli firm Discover-Tech facilitates the campaign, partnering with spyware vendors like Candiru.
Which organizations have been affected?
Devices at Al Jazeera, the U.S. Department of Defense, NATO, and the IAEA were affected.
