Citizen Lab uncovers government spyware delivered through online adverts
Citizen Lab says spyware called AdFection can infect phones and computers simply by displaying an online advert, without the user clicking or taking any other action. The researchers describe it as the first confirmed case of government-backed, zero-click spyware delivered through online advertising, raising concerns about the use of routine ads to target people.
The report says Israeli company Discover-Tech used advertising systems to identify and target users, embedding malicious code in ads shown across websites and apps. It reportedly served 442 million ads on more than 120,000 sites, including the BBC and New York Times, and targeted journalists, Al Jazeera staff and people linked to organisations such as NATO, the European Commission, NVIDIA and Arm. Google said it blocked Discover-Tech from its ad platforms after an investigation with Citizen Lab and Confiant.
- AdFection spyware can infect devices through ads without a click.
- Discover-Tech reportedly served 442 million ads across 120,000 sites.
- Google blocked the company after an investigation.
New here? Start with this
Spyware is software designed to secretly monitor or access a device. Most digital attacks require someone to click a link or install a file, but “zero-click” attacks can work without any action from the person targeted.
Online adverts are placed through networks that connect advertisers with websites and apps. Citizen Lab is a research group at the University of Toronto that investigates digital threats, while Discover-Tech is an Israeli advertising technology company; Google runs major advertising platforms used to place ads across the internet.
The case matters because advertising is a routine part of browsing, and malicious code in an advert could reach people as they use ordinary websites or apps. The report says the targeting included journalists and people linked to public bodies and technology firms, raising questions about how advertising systems can be used for surveillance.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The report points to a serious threat to privacy and security: if ordinary ads can install spyware without a click, people may be exposed simply by using familiar websites or apps. Targeting journalists and people connected to public institutions raises concerns about surveillance chilling reporting and undermining trust in advertising systems; blocking the company from Google’s platforms is therefore a defensible protective step.
The case against
Governments may argue that spyware can be a valuable tool for investigating serious threats, and that covert methods can be necessary when suspects evade conventional surveillance. They could also contend that the report’s findings do not, by themselves, establish the purpose or legality of each alleged targeting, so responses should distinguish legitimate, authorised investigations from abuse while relying on evidence and due process.
Read the full article at the source →
Originally published by Engadget as “CitizenLab details new spyware triggered by online advertising”.