Key points
- Citizen Lab researchers identified a zero-click spyware campaign dubbed AdFection within the digital advertising ecosystem.
- The actor, Discover-Tech, used the Controlium platform to fingerprint users and install malware when ads were displayed.
- Major networks including Google and Yandex hosted these ads before disconnecting the vendor following disclosure.
The short version
- Mobile device users browsing websites or apps were exposed to spyware without clicking on any advertisements.
- The campaign exploited real-time bidding systems to deliver malicious code alongside standard ad content.
- Affected individuals had their movements tracked and data collected by the Controlium platform.
The details
Researchers at The Citizen Lab identified a sophisticated operation they named AdFection, which exploits the online advertising infrastructure to distribute mercenary spyware, according to reports from CSO Online and Computerworld. This technique requires no interaction from the victim; simply viewing an advertisement triggers the infection process on Android and iOS devices.
The mechanism relies on the real-time bidding model, where ad exchanges host auctions billions of times daily. When an ad slot appears on a user's screen, a bid request is sent, and the winning advertiser pushes code to the device within seconds. This code can include malicious payloads alongside images or video, allowing attackers to bypass traditional user-defence mechanisms that rely on preventing clicks.
The primary actor behind this operation is Discover-Tech, which operates the Controlium platform. This system enables cybercriminals to precisely profile and de-anonymise millions of users, creating detailed fingerprints of their digital habits. Once a user is identified, the platform automatically infects their device when the associated ad is displayed.
The scale of this exposure was significant, with ads shown on nearly 200,000 unique websites and within applications across dozens of countries over a four-month period. The operation successfully masqueraded as a legitimate entity, securing certified and approved vendor status with major industry players including Google and IAB Europe. This legitimacy allowed the ads to be served through prominent networks such as Google, Yandex, and Beeswax, reaching a vast audience without raising immediate suspicion.
The campaign also targeted users in the European Union by exploiting General Data Protection Regulation consent frameworks. Researchers noted that the online advertising system failed to detect or prevent this abuse, highlighting structural flaws in how vendors are vetted and monitored.
Following the disclosure of these findings, Google, IAB Europe, Beeswax, Vungle, and Eskimi took action to disconnect Discover-Tech’s access to the digital advertising ecosystem. However, the initial exposure period left many users vulnerable to data collection and device compromise. The researchers warned that this incident illustrates how the ad industry can become a pipeline for spyware when security controls are insufficient.
The context
The real-time bidding model is central to modern digital advertising, facilitating the rapid delivery of personalised content. This speed and scale, however, create challenges for security monitoring. The volume of transactions means that automated systems must process vast amounts of data quickly, often prioritising delivery efficiency over deep inspection of the code being served.
Discover-Tech’s ability to maintain certified status suggests that vendor verification processes may not adequately assess the actual behaviour of the software being deployed. The use of GDPR consent mechanisms to target EU victims indicates a deliberate attempt to leverage regulatory compliance as a cover for malicious activity. This approach undermines user trust in privacy controls, as consent given for advertising purposes was effectively used to facilitate espionage.
Defender's checklist
- Monitor network traffic for unusual outbound connections from mobile devices, particularly when apps are idle.
- Review the permissions granted to advertising SDKs within popular applications to limit data access.
- Check for unknown processes or services running in the background that may be associated with ad delivery.
- Verify the security posture of ad networks used in corporate environments to prevent supply chain compromises.
If your data is involved
Users who have accessed websites or apps during the period of this campaign should assume their device may have been fingerprinted. Check for unusual battery drain or data usage, which can indicate background tracking activities. Review account security settings for any unexpected changes or new login locations. Be vigilant against follow-up phishing attempts, as attackers often use stolen data to craft convincing messages.
Change passwords for critical accounts, especially if they were accessed on the potentially compromised device. Enable multi-factor authentication to add an extra layer of security. Monitor financial statements for unauthorised transactions. Report any suspicious activity to your service provider. Regularly update your operating system and applications to patch known vulnerabilities. Consider using a trusted antivirus solution to scan for persistent threats.
Background: Phishing
Phishing is a broad, automated attack sent to thousands of recipients using generic templates. Spear phishing targets specific individuals or organisations using researched personal details. The core difference lies in the level of personalisation. You defend against phishing with technical filters and against spear phishing with verification protocols and human awareness.
Read the full guide: Phishing vs Spear Phishing: Targeting Mechanics and Defence
What to do and how to stay safe: Discover-Tech
- Update your mobile operating system and all installed applications to the latest version to mitigate known vulnerabilities.
- Review and restrict app permissions, particularly for location and contact access, to limit data exposure to advertising networks.
- Use a reputable ad-blocker or privacy-focused browser to reduce the number of third-party scripts loaded on your device.
- Monitor your accounts for suspicious activity and enable multi-factor authentication where available.
Step-by-step guide: What is online tracking: how data follows you and how to stop it
General security guidance from the Cipher Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is AdFection?
AdFection is a zero-click mercenary spyware campaign identified by Citizen Lab researchers that exploits the online advertising ecosystem to infect devices.
Which companies were involved in hosting these ads?
The ads were presented through major networks including Google, Yandex, and Beeswax, with Discover-Tech listed as a certified vendor by Google and IAB Europe.
How can users protect themselves from this type of attack?
Users should keep their devices updated, limit app permissions, and use ad-blockers to reduce exposure to malicious code delivered through advertising networks.
