Researchers found that a company posing as a legitimate ad vendor delivered zero-click spyware to mobile devices through major advertising platforms.
Key points
- Discover-Tech used the Controlium platform to deliver spyware without user clicks.
- The actor was listed as an approved vendor by Google and IAB Europe.
- Ads served through Google, Yandex, and Beeswax targeted users in dozens of countries.
Researchers at The Citizen Lab identified a campaign dubbed AdFection that delivered mercenary spyware to mobile devices without requiring user interaction. The operation exploited the online advertising ecosystem by masquerading as a legitimate vendor.
What happened
Discover-Tech operated the Controlium platform, which allowed criminals to profile and fingerprint users automatically when ads displayed on their devices. According to The Citizen Lab, this actor was listed as a certified and approved vendor by Google and IAB Europe. This status enabled the company to operate within the legitimate digital advertising supply chain.
Over a four-month period, Discover-Tech’s ads appeared on nearly 200,000 unique websites and in Android and iOS apps across dozens of countries. The campaign utilized major networks including Google, Yandex, and Beeswax to distribute the malicious code. The researchers noted that the actor even exploited European General Data Protection Regulation consent frameworks to target victims in the EU.
The Citizen Lab disclosed these findings to Google, IAB Europe, Beeswax, Vungle (Liftoff), and Eskimi. All named entities took action to disconnect Discover-Tech’s access to the digital advertising ecosystem. The researchers warned that the incident illustrates structural flaws in the online advertising system that failed to detect the abuse.
Why it matters
The online ad market relies on real-time bidding auctions that occur hundreds of billions of times daily. When an ad slot opens on a device, advertisers bid in split seconds to push content, which can include executable code. This speed and scale make it difficult for platforms to inspect every ad for malicious payloads before delivery.
Why it matters
Teams usually monitor application logs for unusual network connections initiated by ad libraries. Check whether your organization’s mobile applications allow third-party ad networks to execute code directly on user devices. Verify that consent mechanisms do not inadvertently grant broad data access to unverified vendors. Review vendor certification processes to ensure they include security audits rather than just compliance checks.
Background: Spyware
Malware is any software designed to harm devices or steal data. Spyware is a specific type of malware that secretly monitors your activity. It captures keystrokes, screenshots, and location data without your consent. You remove it by scanning with updated security software and revoking suspicious app permissions.
Read the full guide: What is Spyware and Malware: How They Steal Data and How to Stop Them
What to do and how to stay safe: Discover-Tech
- Review the permissions granted to ad-supported applications on your mobile devices.
- Check if your browser or operating system settings allow you to limit ad tracking.
- Monitor network traffic for unexpected connections to unknown domains when using apps.
- Wait for vendor updates that address supply chain security in advertising libraries.
Step-by-step guide: Supply Chain Attack Warning Signs and Response Steps
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is AdFection?
AdFection is a term used by researchers to describe zero-click mercenary spyware delivered through the online advertising ecosystem.
How did Discover-Tech avoid detection?
The company masqueraded as a legitimate ad company and was listed as a certified vendor by Google and IAB Europe.
Did any companies take action?
Yes, Google, IAB Europe, Beeswax, Vungle, and Eskimi disconnected Discover-Tech’s access after researchers disclosed the findings.
