How Mercenary Spyware Hacked the Ad System Itself

The ad industry thought it was vetted. It wasn’t.

For years, the programmatic advertising ecosystem ran on a simple trust assumption: if an ad vendor carries a certification from a major platform or trade body, it can be trusted to operate within accepted boundaries. That assumption just collapsed. A report by the Citizen Lab revealed that an Israeli firm called Discover-Tech used its certified status with Google and IAB Europe as a vector for delivering zero-click exploits that installed mercenary spyware on the devices of targeted individuals across government, military, and critical infrastructure networks worldwide.

This is not a story about a single compromised publisher or a rogue ad network operating on the fringes. This is a story about a vetted vendor operating inside the trusted core of the digital advertising supply chain — and using that trust to turn the global ad system itself into a surveillance delivery mechanism.

How AdFection worked

The campaign, dubbed AdFection, exploited the mechanics of programmatic advertising in a way that flips the standard threat model on its head. Normally, ad fraud schemes steal impressions or inflate click-through rates. AdFection did something far more dangerous: it turned targeted ads into payload-delivery vehicles.

Discover-Tech had built a relationship with Candiru, an Israeli surveillance firm later rebranded as Integrity Labs. Candiru’s clients — typically governments and law enforcement agencies looking to target specific individuals — provided profiles of interest. Those profiles were fed into Discover-Tech’s ad platforms. When an ad matched the profile of a person on a Candiru watch list, the ad served contained malicious JavaScript or code that reached back to Candiru’s control servers. Those servers then delivered a zero-click exploit payload designed to install spyware on the device.

The sophistication here is what makes this so alarming. Zero-click exploits require no interaction from the target. No link to click, no file to open. The exploit activates the moment the ad renders on the screen. For anyone whose device loaded a Discover-Tech ad through Google, Yandex, or Beeswax while carrying a profile flag, the infection happened passively.

The targets were not random

The victims were not everyday internet users. According to the Citizen Lab report, Discover-Tech ad impressions appeared on networks linked to NATO, the United Nations, European legislative bodies, Australian critical infrastructure providers, and the armed forces and government agencies of Norway and Sweden.

These are organizations that invest heavily in network security. They employ dedicated IT teams, firewalls, endpoint protection, and vulnerability management programs. Yet they were infected through the advertising layer — the part of their network that security teams traditionally treat as a low-risk entry point, something behind a permissive web gateway rather than a hardened perimeter.

The fact that these networks were compromised tells us something important about how the ad tech ecosystem is integrated into organizational infrastructure. Modern enterprises allow programmatic ads to flow freely across internal networks because blocking ads would break too many workflows. That convenience is exactly what AdFection exploited.

Who gets the blame — and who should

Google and IAB Europe listed Discover-Tech as a certified or verified vendor. That designation implied a level of due diligence. After the report surfaced, Google removed Discover-Tech from its ad vendor registries and terminated its access to ad exchange platforms entirely. IAB Europe also delisted the firm. Beeswax removed Discover-Tech from its buying platform. Vungle, which operates under Liftoff, paused access while conducting a review. Eskimi blocked the company’s accounts and domains.

The rapid responses are notable. But the real question is whether these companies could have prevented this in the first place. Certifications are static checkpoints, not continuous monitoring systems. A vendor can be vetted once and then operate unchecked for years. Discover-Tech was apparently serving malicious ads through certified infrastructure for an extended period before anyone noticed.

Citizen Lab was blunt in its assessment: the campaign illustrated “structural flaws with the online advertising system, which failed to detect or prevent the abuse documented in this report.” The problem is not that one vendor went bad. The problem is that the system had no mechanism to catch that kind of abuse.

Why this changes the threat model

The conventional cybersecurity framework treats the advertising supply chain as a supply-chain risk — a potential entry point, but one that is generally understood and somewhat contained. AdFection reframes the problem entirely. The advertising ecosystem is not just a potential vector; it is a targeting and delivery system that can reach any user on the internet who loads a webpage containing a programmatic ad, regardless of where that user sits in an organizational hierarchy.

This matters because programmatic advertising touches nearly every corner of the connected world. It runs on news sites, government portals, enterprise intranets, hospital networks, and military communications platforms. The same ad exchange that serves banner ads to a journalist can also serve them to a defense minister. There is no meaningful technical separation between the two.

The mercenary surveillance industry has always wanted more precise targeting. With AdFection, it finally got it — but not through better intelligence gathering. It got it through the advertising infrastructure itself, using the targeting data that platforms like Google had already collected to identify and reach specific individuals at scale.

What happens next

The vulnerabilities exploited in AdFection were almost certainly zero-days. Citizen Lab’s report does not name them, which strongly suggests they have already been patched after the research team flagged the campaign. That is the nature of zero-click weapons: they are precious, single-use assets that lose their value the moment they are discovered.

But the delivery mechanism — the use of programmatic ads as a spyware distribution channel — is reusable. Any adversary with access to an ad vendor, even a certified one, can replicate the approach. The infrastructure already exists. The targeting data is already being collected. The only question is who builds the next iteration.

Citizen Lab has called on advertisers and government officials to take concrete action to prevent campaigns like AdFection from recurring. For individual users, the lab recommends installing ad blockers, resetting mobile advertising IDs on iOS and Android, deploying ad-blocking software on home and office networks, and keeping systems updated. None of these are novel recommendations, but they take on new urgency when the threat is no longer a phishing email or a compromised download — it is the ad banner on the news site you visit every morning.

The broader industry will need harder solutions. The current ad tech vetting process is clearly insufficient for a world where mercenary surveillance firms can purchase access to certified ad vendors and use them to wage targeted attacks. Certifications need to become continuous, not periodic. Real-time threat intelligence needs to be integrated into the supply chain, not treated as a separate concern.

Until then, the question is not whether the next AdFection-style campaign will emerge, but when. The tooling is already proven. The trust gap is already exposed. And the advertising industry, which makes its living on the premise that it can reach anyone, anywhere, with the right message, now has to confront the possibility that the right message is the one that infects you.