• Home
• cyber security

Digital Advertising Becomes a Spyware Delivery Channel

Online advertisements are at the center of a newly uncovered cyber espionage operation involving spyware known as AdFection, according to an investigation by Citizen Lab.

The spyware can reportedly reach smartphones and computers simply when a malicious advertisement is displayed, eliminating the need for a user to click a link, download a file or take another direct action.

Researchers described the findings as evidence of how advertising infrastructure can be repurposed to deliver government-backed spyware through attacks requiring no interaction from the targeted user.

Discover-Tech Linked to the AdFection Campaign

Citizen Lab linked the technology used in the operation to Discover-Tech, an Israeli company that presents itself as a legitimate advertising business.

The investigation found that the campaign targeted journalists and employees working for a media organization in the Middle East, as well as officials and employees associated with organizations including NATO and the European Commission.

Employees at technology companies Nvidia and Arm were also among those reportedly targeted.

Bill Marczak, a senior researcher at Citizen Lab, told the Financial Times that Discover-Tech had exploited the digital advertising ecosystem for years, turning trusted websites and popular applications into potential distribution channels for spyware.

Malicious Code Can Hide Behind Legitimate-Looking Ads

The operation reportedly took advantage of programmatic advertising, where automated real-time auctions allow advertisers to target specific categories of users.

According to the investigation, Discover-Tech used the system to identify potential targets and expose information that would normally remain anonymous within the advertising ecosystem.

Malicious code was then placed inside advertisements designed to appear legitimate. When those advertisements were delivered to targeted devices, the spyware could reportedly be deployed without the victim interacting with the ad.

Google Removes Discover-Tech From Its Ad Network

Google was among the major advertising platforms affected by the operation.

Following a joint investigation involving Google, Citizen Lab and cybersecurity company Confiant, Google said it had blocked Discover-Tech from its advertising platforms and removed the company from its global supplier list.

Google said the action followed systematic violations of its advertising policies.

442 Million Ads Reached More Than 120,000 Websites

Citizen Lab’s analysis found that Discover-Tech delivered approximately 442 million advertisements across more than 120,000 websites.

Some of the ads appeared on major media websites, including the BBC and The New York Times.

The campaign also extended to mobile applications, with ads appearing in apps including Duolingo, Badoo and Grindr.

The reported exposure was not limited to ordinary users. Devices belonging to military and government organizations, critical infrastructure operators and national cybersecurity agencies were also among those affected.

Citizen Lab Finds Links to Commercial Spyware Industry

Researchers also discovered login records on Discover-Tech’s website containing information associated with employees of Candiru, a company known for developing commercial spyware.

The finding adds another connection between the advertising operation and the wider commercial surveillance industry.

Researchers Warn the Threat May Be Larger

Citizen Lab cautioned that the newly identified activity could represent only part of a broader operation.

Marczak warned that other similar campaigns may exist but have yet to be identified.

For individuals who could be targeted because of their identity or profession, researchers recommended limiting advertising tracking on their devices or using ad-blocking tools to reduce the potential exposure of their digital activity and data.