Researchers at The Citizen Lab have documented a mercenary spyware pipeline that placed malicious-capable ads on 120,768 websites and inside 75,373 apps in just four months — no click required from the target.

The operation, dubbed "AdFection," runs through a company called Discover-Tech and its Controlium platform. Controlium lets operators "precisely profile and de-anonymize" millions of users, fingerprint their devices, and silently infect chosen targets the moment an ad renders. Discover-Tech masqueraded as a legitimate ad vendor, appearing as "certified" and "approved" in programs run by Google and IAB Europe.

An analyst at Dickson Research, Frank Dickson, put the mechanism bluntly: "The ad was clean; that is the frightening part. Nobody clicked anything." Each ad called home with the device's advertising ID and IP address. The server sent back nothing in almost every case; only selected targets received malicious code.

What does this change for enterprise security?

Plenty. Discover-Tech's impressions landed on networks belonging to NATO, Intel, Microsoft, and Apple, plus security organizations, critical infrastructure operators, and media companies worldwide. Using AdFection, Israeli mercenary spyware vendor Candiru infected devices at Al Jazeera — including Windows software. The report is careful to note that an impression is not an infection, but the targeting clearly reached enterprise networks.

The delivery rail is the real-time bidding (RTB) system that powers online advertising. Ad exchanges run by companies like Google host these auctions "hundreds of billions" of times a day. When an ad box appears, DSPs and SSPs share device identifiers — precise location, cookie ID, mobile ad ID, IP address — so advertisers can decide whether to bid on a specific individual. In split seconds, the winner pushes an ad that can carry code.

"The auction system is designed to enable targeting single individuals," the researchers explained. "The totality of information gleaned from ad auctions is quite valuable." Companies with auction access can track users across cellular, Wi-Fi, and VPNs without their knowledge.

Discover-Tech's ads also ran through major networks including Google, Yandex, and Beeswax, and exploited GDPR consent frameworks to reach victims inside the EU. After Citizen Lab's disclosure, Google, IAB Europe, Beeswax, Vungle (Liftoff), and Eskimi all disconnected Discover-Tech's access.

"Discover-Tech's mass abuse, privacy invasion, and facilitation for mercenary spyware attacks illustrates structural flaws with the online advertising system, which failed to detect or prevent the abuse," the researchers warned.

Why did certification fail?

Vetting often amounted to self-attestation — a box checked on a form. Discover-Tech held certified or approved status for years. "A certification is only as good as the vetting behind it," Dickson said. "Third-party verification scanners saw a harmless banner, because for nearly every viewer, it was one."

Steps enterprises should take now

Dickson's recommendations:

• Push a vetted ad-blocking extension to managed browsers through policy, not user choice.
• Favor browsers with built-in tracking protection.
• Block ad and tracking domains at the DNS or secure web gateway layer — this reaches in-app ads on managed phones, which browser extensions miss.
• Disable advertising identifiers on corporate mobile devices via MDM, and restrict ad-supported consumer apps on devices holding sensitive data.
• Turn on Apple's Lockdown Mode for high-risk executives, journalists, and travelers to sensitive locations.
• Keep browsers and OSes patched: "The ad is only the delivery truck; the exploit still needs a flaw."
• Watch traffic tied to ad impressions for odd follow-on requests.
• Search DNS and proxy logs for the domains published in the report.

One control stands above the rest. The Citizen Lab report states that blocking advertising identifiers alone would have stopped this attack method. Yet many enterprises, as Dickson observed, spend fortunes managing user identities and then let corporate phones hand a persistent identifier to anonymous auctions running hundreds of billions of times a day.

"Every ad is someone else's code running on your device," Dickson said. "Treat the ad network like any other untrusted vendor."