AdFection Spyware Campaign Leverages Targeted Ads for Zero-Click Infections

Citizen Lab has revealed a novel spyware campaign, dubbed AdFection, which exploits the digital advertising ecosystem to deliver potent mercenary spyware without requiring any user interaction. The campaign, facilitated by the Israeli company Discover-Tech, masquerades as a legitimate advertising firm but secretly directs millions of devices to connect with spyware providers, most notably the well-known firm Candiru. This discovery highlights a significant shift in threat actor tactics, moving beyond traditional phishing or exploit kits to leverage the pervasive nature of online advertising for large-scale surveillance.

The AdFection campaign's primary mechanism involves Discover-Tech's targeted advertisements, which have appeared on a wide array of sensitive networks globally. These include critical infrastructure such as the U.S. Department of Defense and NATO, as well as media organizations like Al Jazeera, where devices were confirmed to be infected. Partner investigators at ad security firm Confiant noted that Discover-Tech's ads were displayed on over 120,000 websites and 70,000 mobile apps between March and June of the current year, indicating a broad reach.

Researchers have linked Discover-Tech to multiple mercenary spyware operations, including Candiru, Bindecy, and Intelos. Discover-Tech operates a platform called Controlium, which reportedly allows its surveillance partners to de-anonymize, fingerprint, and automatically infect devices as soon as an advertisement is rendered. This sophisticated infrastructure enables a high degree of automation and stealth in the infection process, making detection exceedingly difficult for targeted organizations.

Beyond direct spyware delivery, the report details a separate threat actor, dubbed DARK CARTOGRAPHER, which utilizes Discover-Tech's infrastructure. DARK CARTOGRAPHER is reportedly exploiting vulnerabilities across numerous mobile carriers to link device advertising IDs with phone numbers, effectively mass-deanonymizing internet users. The overlap between mercenary adtech vendors and U.S. government or intelligence contractors in this operation is noted as a rare and concerning development.

In response to Citizen Lab's findings, major players in the adtech industry have taken action. Google has removed Discover-Tech from its vendor registries and terminated its access to Google ad platforms. Similarly, IAB Europe has removed Discover-Tech from its global vendor list. These actions underscore the industry's growing awareness of the risks associated with its vendor ecosystem and the potential for abuse.

While the AdFection campaign itself cannot be definitively attributed to a specific entity, the technical capabilities and reach demonstrated are significant. The spyware associated with Candiru is known for its ability to remotely take over devices, steal sensitive data, and access microphones and cameras, posing a severe threat to individuals and organizations.

The researchers emphasize that the digital advertising industry needs a fundamental reevaluation of its security practices and responsibilities. The current ecosystem, optimized for profit and targeted advertising, has inadvertently created a fertile ground for surveillance operations. Cybersecurity agencies, regulators, and lawmakers are urged to investigate companies like Discover-Tech and address the systemic risks that enable such malicious targeting.

The discovery of AdFection raises critical questions about the accountability of advertising technology vendors and the oversight mechanisms in place to prevent the weaponization of online advertising. The potential for widespread, zero-click surveillance through seemingly innocuous ads presents a clear and present danger to privacy and security globally.