AdFection: Spyware Networks Exploiting Online Advertising Infrastructure
Citizen Lab reveals how zero-click spyware leverages ad networks for targeted surveillance.
1The AdFection Surveillance Mechanism
Spyware vendors are weaponizing online advertising infrastructure to profile targets without requiring user interaction. Citizen Lab identified Discover-Tech as a central entity facilitating these operations. By utilizing ad-delivered exploits, attackers bypass traditional security measures, effectively turning standard web browsing into a vector for silent, zero-click device compromise and surveillance.
2Scale of the Operation
Between March and June 2026, Discover-Tech’s MyDSP platform participated in massive bidding activity. The company bid on over 3.77 billion ad impressions, successfully winning 442 million. These advertisements reached more than 120,000 websites and 70,000 mobile apps, demonstrating the vast reach of this infrastructure in profiling potential targets globally.
3Targeting Sensitive Organizations
The investigation confirms that Al Jazeera was targeted in zero-click attacks between 2024 and 2025, resulting in at least 45 compromised devices. Furthermore, advertising records show impressions appearing on networks linked to the Pentagon, NATO, the United Nations, and the European Commission, highlighting the significant intelligence risks posed to critical institutions.
4Links to Known Vendors
Citizen Lab established clear connections between Discover-Tech and Candiru, an Israeli spyware vendor previously placed on the US Entity List in 2021. The infrastructure also involved other surveillance firms like Bindecy and Intelos. These entities operated under various aliases, such as Integrity Labs, to maintain access to legitimate advertising exchanges.
5Industry Complicity and Oversight
Despite clear links to the surveillance industry, Discover-Tech maintained approved vendor status with Google and IAB Europe for years. This allowed their malicious activity to appear legitimate. Following the investigation, major platforms including Google, Beeswax, and Vungle terminated access, while Eskimi blocked the company's accounts to mitigate further security risks.
6Challenges for Security Teams
Traditional security defenses often fail against ad-delivered threats because they focus on malicious links or unauthorized connections. AdFection exploits services that organizations routinely permit for web browsing. Because the advertising ecosystem involves complex chains of buyers and third-party scripts, malicious behavior remains difficult to detect through automated scanning alone.
7Mitigation and Defense Strategies
Organizations must treat online advertising as a significant attack surface. Security teams should implement network-level ad blocking and disable ad personalization on managed devices. Reviewing traffic for unexpected external connections and restricting browser extensions are essential steps for protecting executives, journalists, and personnel handling sensitive information from potential espionage attempts.
8The Future of Ad Security
The AdFection investigation underscores that online advertising is no longer merely a privacy concern but a potent operational tool for espionage. As adversaries leverage these familiar user experiences for silent exploitation, the reliance on automated ad exchanges requires stricter oversight to prevent the weaponization of legitimate digital marketing channels.