Citizen Lab Reveals AdFection Zero-Click Spyware in Targeted Ads

AdFection is a zero-click spyware campaign delivered through targeted online advertising. Researchers at the University of Toronto’s Citizen Lab revealed its first technical details on Thursday, marking the first technical demonstration of infections and distribution through targeted advertising.

An online ad for earbuds might seem harmless. Same for a drone. Or a bubble gum-scented car air freshener. But Citizen Lab found that these placements can be a gateway for mercenary spyware that infects a device without any click, and that's a fact you can't ignore. Earlier reports had touched on the existence of spyware distributed through ads. So this is the first technical demonstration of infections and distribution through targeted advertising.

Discover-Tech calls itself a legitimate advertising firm. It's not. In reality, it operates as a facilitator for multiple mercenary spyware partners, including the well-known Candiru, and its ads covertly direct millions of devices to contact Candiru's servers, which researchers said likely aims at large-scale tracking and surveillance, enabled by accident by major industry players like Google. So Discover-Tech was registered in 2020. It's facilitated mercenary spyware since at least 2024. Researchers also connected Discover-Tech to another mercenary hacking firm, Bindecy, and a mercenary ad intelligence firm, Intelos, and we've got no reason to think they're wrong.

Zero-Click Mechanics

Discover-Tech operates a platform called Controlium. It enables mercenary surveillance partners to de-anonymize, fingerprint, and automatically infect devices the moment an advertisement is rendered. No click is required. The load of the ad creative becomes the attack trigger.

What Controlium Enables

• De-anonymizing users
• Fingerprinting devices
• Automatic infection on ad render

Between March and June of this year, researchers found Discover-Tech ads displayed in over 120,000 websites and over 70,000 mobile apps.

Sensitive Networks and a Newsroom

One Newsroom, 45 Devices

At least 45 devices at Al Jazeera were targeted. These were zero-click attacks. Citizen Lab linked them with high confidence to Candiru spyware, which was delivered by Discover-Tech's ads, and that's the chain they're pointing to. Candiru's spyware has shown the ability to take over a device remotely, steal data from it, and access its microphone and camera, so we've got a tool that can't be ignored. It's invasive.

• Remote device takeover
• Data theft
• Microphone and camera access

Discover-Tech’s ads also appeared on many sensitive networks around the world. Partner investigators at ad security firm Confiant found them across the U.S. Department of Defense, NATO, the International Atomic Energy Agency, and world cybersecurity agencies.

Industry Giants Step In

Before the removal, Discover-Tech had appeared on lists of certified and approved vendors maintained by Google and IAB Europe. Google has now removed Discover-Tech from its vendor registries and ended the company’s access to Google ad platforms. IAB Europe removed Discover-Tech from its global vendor list.

Jerome Dangu, chief technology officer and co-founder of Confiant, said the industry optimized against cyber criminals, scams, and malware for profit, but not for surveillance.

Jerome Dangu, chief technology officer and co-founder of Confiant, said: "The adtech industry, the digital advertising industry, has a lot of rethinking to do to reconsider how they approach these threats of surveillance and the responsibilities that they have with the data that they collect and how it might be abused.

Wolfie Cristl, senior researcher at Citizen Lab, called it disastrous that ad vendors did not detect the operation for years. Wolfie Cristl said cybersecurity agencies, regulators, and lawmakers in the U.S., Europe, and other regions must urgently step in.

Wolfie Cristl, senior researcher at Citizen Lab, said: "Digital advertising is broken. The way the online advertising ecosystem works today is a security threat for states, the private sector, civil society and everyone else alike.

DARK CARTOGRAPHER and the U.S. Government Connection

DARK CARTOGRAPHER involves Discover-Tech and other vendors, including an unnamed U.S. intelligence contractor, and its activities date back to 2019. It uses Discover-Tech’s infrastructure to exploit vulnerabilities across numerous mobile carriers, linking device advertising IDs with phone numbers and mass-deanonymizing internet users. Citizen Lab said it will detail findings concerning this threat actor in a separate forthcoming report.

Its infrastructure links to both a mercenary adtech vendor and a U.S. government contractor. The report states: "It is rare to see such direct overlaps between mercenary vendors and U.S. government or intelligence contractors.

What Comes Next

Citizen Lab said regulators need to investigate Discover-Tech and levy sanctions. The online advertising industry has a lot of rethinking to do, Dangu said, around surveillance threats and data responsibilities. Discover-Tech, Candiru, Bindecy, and Intelos did not respond to letters seeking comment. The findings leave both regulators and ad platforms with uncomfortable questions.