Key points
- AdFection delivers zero-click spyware through targeted digital advertisements.
- The campaign involves Discover-Tech facilitating surveillance for partners like Candiru.
- Ads appeared on sensitive networks including the U.S. Department of Defense.
The Citizen Lab at the University of Toronto and ad security firm Confiant revealed that targeted digital advertisements can serve as gateways for mercenary spyware. This campaign, named AdFection, allows malicious code to infect devices without requiring the user to click on the ad. The researchers identified this mechanism as a significant shift in how surveillance tools reach their targets.
By the numbers
- 2020: The year Discover-Tech was registered as a business entity.
- 2024: The earliest confirmed date for Discover-Tech facilitating mercenary spyware operations.
- 2019: The start date for activities linked to the DARK CARTOGRAPHER group.
What the figures mean
Discover-Tech presents itself as a legitimate advertising firm but operates as a facilitator for multiple mercenary spyware partners, including the known threat actor Candiru. According to The Citizen Lab, these ads covertly direct millions of devices to contact Candiru’s servers. The likely goal is large-scale tracking and surveillance, a capability enabled by major industry players like Google. The campaign has led to infections at media outlet Al Jazeera.
Confiant investigators found that Discover-Tech’s ads appeared on many sensitive networks worldwide. These locations include the U.S. Department of Defense, NATO, the International Atomic Energy Agency, and various world cybersecurity agencies. Wolfie Cristl, a senior researcher at The Citizen Lab, described the failure of ad vendors to detect this operation for years as disastrous. The activities of the shadowy DARK CARTOGRAPHER outfit, which involves Discover-Tech and an unnamed U.S. intelligence contractor, date back to 2019.
What to watch
Jerome Dangu, chief technology officer and co-founder of Confiant, stated that the digital advertising industry has optimized defenses against cybercriminals seeking profit, not surveillance. He noted that the industry needs to rethink its approach to surveillance threats and data responsibilities. The Citizen Lab said regulators need to investigate Discover-Tech and levy sanctions. The researchers emphasized that digital advertising is broken and requires significant structural changes to prevent abuse.
Infection and persistence in general
Teams usually monitor network traffic for unusual outbound connections to unknown domains. Analysts check whether devices are contacting servers associated with known spyware vendors. They examine ad injection logs for discrepancies in content delivery. Security operations look for patterns of zero-click exploitation in web browsers. Teams verify that ad filtering tools are blocking malicious creatives. They assess whether endpoints are communicating with command and control infrastructure. Analysts review DNS queries for signs of covert data exfiltration.
Background: Spyware
Look for unexplained battery drain, microphone LED activity, or network traffic spikes. Check for unknown admin accounts and disabled security tools. Isolate the device immediately. Do not attempt to clean it while connected to the network. Assume data is already exposed.
Read the full guide: Spyware Warning Signs: What to Spot Before Data Is Stolen
What to do and how to stay safe: AdFection
- Monitor network logs for unexpected connections to domains linked to mercenary spyware vendors.
- Review ad injection logs to identify and block malicious advertising creatives.
- Verify that endpoint detection tools are configured to alert on zero-click exploitation attempts.
- Wait for the vendor to provide an update once a fix is confirmed.
Step-by-step guide: Ransomware Incident Response: A Step-by-Step Operational Playbook
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is AdFection?
AdFection is a campaign that delivers zero-click spyware through targeted digital advertisements, allowing infection without user interaction.
Who is behind the AdFection campaign?
The campaign involves Discover-Tech, which facilitates mercenary spyware for partners like Candiru, and is linked to the DARK CARTOGRAPHER group.
Which organizations were affected by this campaign?
Devices at Al Jazeera were infected, and ads appeared on networks including the U.S. Department of Defense, NATO, and the IAEA.
