AdFection software exploits digital ads for zero-click surveillance

A joint investigation by the University of Toronto’s Citizen Lab and New York-based cybersecurity firm Confiant has uncovered a sophisticated surveillance technique dubbed 'AdFection.' This method, developed by the Israeli company Discover-Tech, utilizes the global digital advertising ecosystem to compromise mobile devices and computers. The exploit functions as 'zero-click' software, meaning it installs itself on target devices without requiring any interaction from the user.

Evidence suggests the technology was leveraged by clients including the Israeli spyware firm Candiru, which is currently on a U.S. government blacklist. Investigators report that the technique was used to compromise devices belonging to journalists and employees of the Al Jazeera news network, with broader implications for NATO, EU officials, and companies like Nvidia. The vulnerability resides in how advertising platforms—including those managed by Google, Comcast, and Yandex—inadvertently serve as conduits for malicious payloads disguised as legitimate advertisements for consumer products.

Wolfie Christl, a researcher at Citizen Lab, warned that the current architecture of online advertising poses a systemic threat to national security, the private sector, and civil society. While the report highlights the severe security risks inherent in automated ad-bidding infrastructures, no specific legal proceedings or immediate patches were cited as the next steps in the current reporting.