Citizen Lab finds ad network used for zero-click mercenary spyware
Researchers say Discover-Tech abused major ad platforms to deploy AdFection spyware without user interaction.
Key points
- Discover-Tech operated Controlium to profile and infect devices via ads.
- The actor was certified by Google and IAB Europe during the abuse.
- Platforms disconnected Discover-Tech after Citizen Lab disclosed findings.
Researchers at The Citizen Lab identified a campaign dubbed AdFection that uses online advertising to deploy mercenary spyware without requiring user clicks. The group found that Discover-Tech exploited the real-time bidding ecosystem to deliver malicious code to Android and iOS devices automatically when ads were displayed on screen.
According to CSO Online, Discover-Tech operates the Controlium platform, which allows attackers to profile and de-anonymize users. The system fingerprints devices and installs malware simply by rendering the ad content. This method bypasses traditional defenses that rely on detecting user interaction with malicious links or downloads.
Structural flaws in ad tech
The online advertising market relies on real-time auctions that occur hundreds of billions of times daily. When an ad slot appears on a device, exchanges like those run by Google facilitate bids in split seconds. Researchers noted that these ads can carry executable code alongside images or video. This speed and scale make it difficult for exchanges to inspect every payload for malicious intent before delivery.
Discover-Tech successfully posed as a legitimate vendor within this system. The company held certified and approved status with major industry bodies, including Google and IAB Europe. This accreditation allowed its ads to be served through prominent networks such as Google, Yandex, and Beeswax. The researchers stated that the advertising system failed to detect or prevent this specific abuse pattern.
Scope of the campaign
Over a four-month period, Discover-Tech’s ads appeared on nearly 200,000 unique websites. The campaign also reached users through Android and iOS applications across dozens of countries. The operation targeted victims in the European Union by exploiting GDPR consent frameworks. According to Computerworld, the researchers warned that this mass abuse illustrates deep structural vulnerabilities in the digital advertising supply chain.
What should you do?
The Citizen Lab team disclosed their findings to Google, IAB Europe, Beeswax, Vungle, and Eskimi. All named platforms took action to disconnect Discover-Tech from their ecosystems. No patch or software update has been confirmed to fix the underlying structural issues in real-time bidding systems. Users should monitor vendor advisories for further developments regarding ad-based threats.
What to do and how to stay safe: Discover-Tech
- Monitor vendor security advisories for updates on ad network integrity and known malicious actors.
- Review application permissions and install only software from trusted, verified sources.
- Keep operating systems and browsers updated to mitigate potential zero-click execution vectors.
- Use network monitoring tools to detect unusual outbound connections from mobile devices.
Step-by-step guide: How to Remove Data from Data Brokers: The Manual Cleanup Process
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is AdFection?
AdFection is a zero-click mercenary spyware campaign that exploits online advertising to infect devices without user interaction.
Which platforms were involved in the Discover-Tech abuse?
Discover-Tech served ads through Google, Yandex, Beeswax, Vungle, and Eskimi while holding certifications from Google and IAB Europe.
Was a fix released for this vulnerability?
No fix has been confirmed yet; platforms disconnected the actor, but structural flaws in the ad system remain.
