Targeted Ads Used for Zero-Click Spyware Delivery, Senators Warn of National Security Risks
A new report reveals targeted advertising techniques are being used to deliver zero-click mercenary spyware, prompting renewed calls for legislative action to address national security concerns.
A recent investigation by The Citizen Lab, in collaboration with ad-tech firm Confiant, has uncovered a sophisticated technique dubbed "AdFection." This method leverages targeted online advertisements to deliver zero-click mercenary spyware, posing a significant threat to users and potentially national security. The findings highlight a critical vulnerability within the digital advertising supply chain, where malicious actors can exploit advertising platforms to distribute harmful software without any user interaction.
Senators Ron Wyden and Cory Booker have seized upon these revelations to renew their calls for legislative reform concerning online advertising and data privacy. They argue that the AdFection technique underscores the growing risks associated with spyware and the increasingly sophisticated methods employed for online tracking and targeting. Senator Booker emphasized the need for stronger privacy protections to keep pace with evolving surveillance threats, while Senator Wyden specifically raised concerns about the security implications for government devices.
Wyden, who has previously characterized adtech as a national security threat, pointed out that advertisements linked to Discover-Tech, a company heavily implicated in the AdFection technique, were served on government networks. He likened the situation to leaving sensitive government facilities unsecured, stating that allowing targeted ads on government devices creates an "open invitation to spies and criminals." Wyden reiterated his previous calls for disabling ads on government browsers and turning off mobile ad IDs, advocating for legislation to ban all targeted advertising.
In response to the report, several major ad platforms and industry bodies have taken action. Google, which participated in the investigation, confirmed it banned Discover-Tech during a joint effort with Citizen Lab and Confiant. The company stated its safety teams continuously blocked malicious ads from the vendor while dismantling the network. Google also highlighted its multi-layered defenses and regular audits of its Authorized Buyer program, noting that its automated systems detect over 99% of policy-violating ads before they reach users.
IAB Europe, an industry association, offered a different perspective, suggesting that the findings point to the misuse of existing web technologies rather than a fundamental flaw in the digital advertising infrastructure. The association stated that while the industry invests in security, investigating unlawful activities like spyware deployment ultimately falls under the purview of competent authorities.
Despite these responses, The Citizen Lab concluded that the advertising industry exhibits "a dangerous lack of due diligence" and criticized "broken digital infrastructure." The report urged ad vendors to enhance their cybersecurity and threat detection capabilities, rigorously vet business partners, audit vendor registries, and ban vendors by default in jurisdictions known for abuse. It also called for regulatory action, including investigations into companies like Discover-Tech and Candiru, and potential sanctions against mercenary spyware firms and their enablers.
The implications of AdFection extend beyond individual privacy, touching upon broader national security concerns. The ability of threat actors to leverage the pervasive nature of online advertising for zero-click spyware delivery highlights the need for a more robust and secure digital advertising ecosystem. As the digital landscape continues to evolve, the intersection of advertising technology and cybersecurity will remain a critical area of focus for both industry stakeholders and policymakers.