No click required: How the ad industry became a pipeline for mercenary spyware

The ad industry has evolved into a network for mercenary spyware, dubbed "AdFection," which exploits online advertising platforms to track users without their knowledge, according to researchers at The Citizen Lab. This zero-click spyware can install malware on devices simply by displaying ads. One key player in this scheme, Discover-Tech, runs a platform called Controlium that allows cybercriminals to profile and de-anonymize millions of users while automatically infecting their devices when an ad is displayed.

Despite masquerading as a legitimate ad company on major platforms like Google and IAB Europe, Discover-Tech's ads have been shown on nearly 200,000 unique websites and apps in dozens of countries. Major ad networks, including Google, Yandex, and Beeswax, have also displayed Discover-Tech's ads. The researchers disclosed their findings to these companies, which took action to disconnect Discover-Tech.

However, the issue lies in the online advertising system's weaknesses, which failed to detect or prevent this abuse. AdFection takes advantage of real-time bidding auctions hosted by ad exchanges, where ads containing images, video, and malicious code are bid on and shown in split seconds. Data about specific users and devices is shared across exchanges, allowing advertisers to target individuals based on device identifiers and other characteristics.

Discover-Tech has infiltrated and connected the spyware industry to this online ecosystem, enabling them to silently infect devices. While not every ad impression leads to infection, the fact that Discover-Tech has been able to bid on and show ads across extensive ad networks highlights a systemic risk that requires urgent investigation.