The invisible ad auction installs spyware on your phone without a click

Long before you see a targeted ad for a new pair of running shoes, your digital profile was auctioned off to dozens of companies in a fraction of a second. This process is the engine of the modern internet. It determines which banners appear on your screen and which videos play before your content. However, a new report from Citizen Lab reveals that this same automated system now delivers sophisticated spyware to unsuspecting targets. The researchers identified a new campaign called AdFection. This attack is unique because it requires no interaction from the victim. You do not need to click a suspicious link or download a malicious file. The mere act of an ad loading on a website or inside a mobile app is enough to compromise a device.

This discovery marks the first confirmed instance of government-backed, zero-click spyware delivered through the global online advertising ecosystem. The technology originated from an Israeli company called Discover-Tech. While the firm presents itself as a legitimate advertising vendor, Citizen Lab describes it as a bridge between the advertising world and the mercenary spyware market. The scale of the operation is vast. Discover-Tech reportedly served 442 million ads across more than 120,000 websites and apps. These included major news outlets like the BBC and The New York Times, along with popular mobile applications such as Duolingo and Grindr.

The mechanics of zero-click ad infections

The advertising ecosystem is a wide-open window in an otherwise locked house. Most modern security focuses on hardening the operating system or the browser against direct attacks. Spyware developers found a way around these defenses by using the Real-Time Bidding (RTB) system. RTB is an automated auction where advertisers bid to show an ad to a specific user based on their data. When you visit a website, the site sends out a request containing your location, device type, and browsing history. Advertisers use this data to decide if they want to target you.

Discover-Tech used this system to profile and de-anonymize specific individuals. Once the system identified a high-value target, it delivered an ad containing malicious code. This code executes as soon as the ad renders on the screen. This is what security researchers call a zero-click exploit. It removes the need for human error. In the past, attackers had to trick a journalist or a diplomat into clicking a link in a text message. With AdFection, the attack succeeds because the victim simply browsed a trusted website or opened a familiar app. The malicious code is buried inside the visual elements of the advertisement. Consequently, the victim remains unaware that their phone or computer is infected.

Targeting the core of global institutions

The list of targets suggests a highly coordinated effort to gather intelligence on international organizations and technology leaders. Citizen Lab found evidence that the spyware targeted staff at the Al Jazeera news network. It also reached employees at NATO and the European Commission. The reach extended into the private sector, affecting personnel at major semiconductor companies like NVIDIA and Arm. The attackers even targeted devices used by national cyber agencies and critical infrastructure providers.

This broad targeting is possible because of the reach of online advertising. Because ads are everywhere, the attack surface is effectively the entire internet. Discover-Tech leveraged the trust users place in popular apps and websites. When a user sees an ad on a reputable news site, they assume the site has vetted the content. In reality, the website owner has very little control over which specific ads appear. The automated auction houses decide the content in real-time. This lack of oversight allows malicious actors to hide in plain sight among millions of legitimate marketing campaigns.

The collapse of anonymity in the bidding process

One of the most concerning aspects of the report is how the attackers used the advertising system to strip away user privacy. The RTB process relies on pseudonymous identifiers. These are strings of numbers and letters that represent a user without using their legal name. In a regulatory context, this is often considered a privacy-preserving measure. However, these identifiers are not truly anonymous. When combined with location data and device metadata, they become a digital fingerprint.

Discover-Tech used these fingerprints to track targets across different apps and websites. This allowed them to wait for the perfect moment to deliver the spyware payload. The researchers also found login records on Discover-Tech's own infrastructure that linked them to other known spyware makers, including a firm called Candiru. This suggests a collaborative ecosystem where different mercenary groups share tools and access methods. The advertising system provides the perfect delivery vehicle for these tools because it is built to bypass traditional firewalls and security filters.

Google and the response of the advertising ecosystem

Google is one of the largest players in the global advertising market. The report indicates that Discover-Tech used Google's platforms to distribute their ads. After a joint investigation with Citizen Lab and the security firm Confiant, Google took action. The company suspended Discover-Tech from its global vendor list and blocked them from its advertising platforms. Google stated that the firm systematically violated policies regarding deceptive practices and malware distribution.

While this suspension is a necessary step, it highlights a systemic vulnerability. The advertising industry operates on a model of massive scale and high speed. Verification of every single advertiser is difficult when millions of auctions happen every second. From a compliance standpoint, this creates a significant risk for platforms. If a platform allows its infrastructure to be used for state-sponsored surveillance, it faces potential legal scrutiny under data protection laws like the General Data Protection Regulation (GDPR) in Europe. Under the GDPR, companies have a duty to ensure that data processing is secure and that they have a valid legal basis for every transaction.

Legal accountability in the mercenary spyware market

The use of advertising for surveillance raises complex legal questions. Most advertising data is processed under the legal basis of Legitimate Interest. This is a provision in privacy law that allows companies to process data if they have a valid reason that does not outweigh the user's rights. Using this data to install spyware is a clear violation of this principle. It is also a violation of the ePrivacy Directive, which requires consent for accessing information stored on a user's device.

There is also the issue of extraterritorial jurisdiction. Discover-Tech is an Israeli firm, but its victims are located all over the world. Many of the ads were shown to users in the European Union and the United States. This means that regulators in these jurisdictions have the authority to investigate the breach of privacy. However, holding mercenary spyware firms accountable is historically difficult. These companies often operate through layers of shell corporations and use complex technical methods to hide their activities. Ultimately, the responsibility often falls on the platform providers to police their own networks more effectively.

Practical steps to secure your digital footprint

The discovery of AdFection proves that standard digital hygiene is no longer enough for high-risk individuals. If you are a journalist, a government official, or a researcher, you must assume that your browsing habits are a vector for attack. The most effective way to mitigate this specific threat is to reduce your exposure to the advertising ecosystem. This is not about hiding from one company. It is about closing the window that the RTB system leaves open.

First, consider using a robust ad blocker. Tools like uBlock Origin prevent the browser from even requesting the ad content from the auction servers. If the ad never loads, the zero-click exploit cannot execute. Second, disable ad tracking on your mobile devices. On Apple devices, use the "Ask App Not to Track" feature. On Android, reset your advertising ID and opt out of personalized ads. These steps make it harder for firms like Discover-Tech to profile you and select you as a target.

Finally, for those at high risk, consider using specialized security modes. Apple's Lockdown Mode, for example, disables certain complex web features that are frequently used in zero-click attacks. While these measures can make the internet less convenient, they are necessary in a world where a simple banner ad is a weapon. The discovery by Citizen Lab is likely just one part of a much larger trend. As long as the advertising ecosystem remains opaque and automated, it will continue to be a target for those looking to bypass digital security.

Sources

• Citizen Lab Report: AdFection: A New Zero-Click Spyware Delivery Platform
• General Data Protection Regulation (GDPR), Article 5 (Principles relating to processing of personal data)
• General Data Protection Regulation (GDPR), Article 32 (Security of processing)
• ePrivacy Directive 2002/58/EC (Directive on privacy and electronic communications)
• Google Policy Statement on Discover-Tech Suspension

Disclaimer: This article is for informational and journalistic purposes only and does not constitute formal legal advice. If you believe your device has been compromised by spyware, consult with a qualified cybersecurity professional or legal counsel specializing in digital rights.