No click required: How the ad industry became a pipeline for mercenary spyware

That ad you just scrolled past on your phone but barely spared a look or click? It could be tracking your movements and collecting your data, without you having to do a thing. This “zero-click mercenary spyware,” dubbed “AdFection,” is increasingly exploiting a sprawling online advertising ecosystem ripe for abuse, according to researchers at The Citizen Lab. One top actor in the space, Discover-Tech, runs the Controlium platform that allows cyber criminals to “precisely profile and de-anonymize” millions of users, fingerprint them, and automatically infect their devices when an ad is displayed. Troublingly, Discover-Tech is successfully masquerading as a legitimate ad company across the online ad sales environment, the researchers said, listed as a “certified” and “approved” vendor by the likes of Google and IAB Europe. Over a four-month period, the company’s ads were shown on nearly 200,000 unique websites and in Android/iOS apps in dozens of countries. Furthermore, its ads have been presented through major networks like Google, Yandex, and Beeswax, and it even exploited the European General Data Protection Regulation (GDPR) consent frameworks to target victims in the EU. The Ci…

≈