AdFection: Zero-Click Spyware Delivered via Legitimate Ad Networks

Researchers at The Citizen Lab identified a supply chain attack dubbed AdFection, where mercenary spyware infects mobile devices through standard advertising displays. The campaign required no user clicks, exploiting the trust inherent in legitimate ad networks to deliver malicious code directly to Android and iOS applications.

Root cause

The underlying issue stems from structural weaknesses in the real-time bidding ecosystem that governs digital advertising. According to The Citizen Lab, this system processes hundreds of billions of auctions daily. Ad exchanges grant winners permission to push content within split seconds. This mechanism allows actors to embed executable code within standard ad formats that execute when the ad is displayed, rather than requiring a user click.

Attack path

Discover-Tech operated the Controlium platform, which enabled cyber criminals to profile and de-anonymise users. The system fingerprinted devices and automatically infected their devices when an ad was displayed. The company successfully masqueraded as a legitimate vendor, securing certified status from Google and IAB Europe. It exploited GDPR consent frameworks to target victims in the European Union while distributing ads through major networks including Google, Yandex, and Beeswax.

Affected versions

The campaign targeted mobile operating systems broadly rather than specific software versions. The Citizen Lab reported that ads were displayed on Android and iOS apps across dozens of countries. The infection vector relied on the ad display mechanism itself, meaning any device receiving a served advertisement from Discover-Tech was potentially affected, regardless of its patch level or specific application version.

Mitigation

• Verify vendor credentials regularly, as certified status does not guarantee security.
• Monitor for unusual network traffic originating from ad delivery SDKs.
• Review consent management platforms for signs of abuse or manipulation.
• Implement strict allow-listing for ad providers to limit exposure to unknown actors.

Why it matters

Security teams often assume that certified vendors within major ecosystems adhere to strict safety standards. This incident demonstrates that compliance certifications can be exploited to gain trust and access. Professionals should understand that real-time bidding systems prioritise speed, creating windows where malicious code can execute before defensive checks occur. Teams usually rely on perimeter controls, but supply chain compromises bypass these by operating within trusted traffic flows.

What to do and how to stay safe: Discover-Tech

• Audit all third-party advertising SDKs integrated into your mobile applications for known malicious actors.
• Monitor network logs for outbound connections to domains associated with the Controlium platform or Discover-Tech.
• Review your vendor approval processes to ensure ongoing security assessments are conducted, not just initial certifications.
• Educate development teams on the risks of embedding executable code within ad creatives served via real-time bidding.

Step-by-step guide: Opting Out of Data Brokers: The Mechanics and Limits of Removal

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is AdFection?

AdFection is a zero-click mercenary spyware campaign that infects devices through advertisements displayed on websites and apps.

Which companies were involved in delivering the ads?

The ads were distributed through major networks including Google, Yandex, and Beeswax, according to The Citizen Lab.

Has Discover-Tech been removed from these platforms?

Yes, Google, IAB Europe, Beeswax, Vungle, and Eskimi disconnected Discover-Tech following the researchers' disclosures.