Anyone who has surfed the web or used a cellphone for any measure of time should know to be suspicious of any sketchy links. Phishing campaigns aren’t new, but since when could even just looking at an ad compromise your device? A malicious ad campaign was found to infect millions of cellphones, computers, and other devices with spyware embedded with surveillance malware. They come from online ads weaponised to hack targets covertly, including government agencies and journalists worldwide. These are now being referred to as “adfections“.
What are These “Adfections” and Where did They Come From?
The malicious ads were purchased by the Israeli-owned company Discover-Tech, which presents itself as a legitimate advertising business. In reality, it has been found to operate as a facilitator for multiple mercenary spyware partners. The Discover-Tech platform de-anonymizes, fingerprints, and exploits vulnerabilities in the advertising system.
The malware in question was developed by another Israeli firm Integrity Labs (formerly Candiru). It uses “adfections” to steal user information, utilize device microphones and camera, messages, and other files they gained access to through the Discover-Tech network. Among the many compromised users, at least 45 journalists from Al-Jazeera have been targeted by this campaign.
Despite appearing on Google’s “certified” and “approved” vendor lists since 2020, Discover-Tech has committed mass privacy invasion by partnering with those responsible for programming the malware. This calls into question the structure of the online advertising machine.
Related Article: WhatsApp Wins Court Ruling Against Spyware Firm NSO Group
How do They Work?
Ad exchanges take place billions of times per day. Furthermore, they’re facilitated through Real-Time Bidding (RTB) auctions operated by companies like Google. The winning photo or video can also run code in the background. The current advertising ecosystem then allows it to track unsuspecting users.
Visiting a website unsuspectingly hosting these ads could have compromised your device. CitizenLab reported over 120,000 websites and 75,000 Android and iOS apps were known to run these attack ads. They install malware automatically without requiring readers to engage at all with the infected files. They simply viewed them on-screen.
The companies that run the ads on these apps and websites don’t know the original source of the ads. This is because they are purchased through third-party brokers. Posing as a legitimate organization, Discover-Tech has been used as a front to commit cyber espionage on a massive scale.
The engineering has gotten so sophisticated that despite having ad blocker extensions enabled, they have not been able to keep up in this rapidly evolving age of surveillance technology. Mercenary spyware campaigns are able to profile and target devices to cyberattacks. They do this by using Discover-Tech’s own server. It bypasses sharing the malicious code with the companies who host and display the infected ads.
Related Article: Lab-Grown “Remilk” from Israeli Startup Coming to North American Stores This Year
What Can be Done to Avoid or Fight Them?
As of October 2026, Discover-Tech has since been removed from both Google and IAB Europe’s ad vendor registries. That said, the fact remains that platforms can still act as an intermediary between ad vendors and surveillance companies without the knowledge of the general public or the host site.
Online ads will continue to pose a cybersecurity risk to everyday citizens, reporters, and governing bodies alike as advertising intelligence increases and regulation stagnates. The lack of transparency that these firms operate under should be a concern to policymakers everywhere. They too are at risk of being a target of these unlawful and immoral attacks.
The mass-theft of private data and data leaks by tech giants has caused a major breach of trust in technological engagement. Everyday users and even entities like the Pentagon are not safe from malicious actors. In 2018 and again in 2020, the National Security Agency (NSA) and Cybersecurity and Infrastructure Security Agency (CISA) warned the public of these kinds of attacks. But due diligence on behalf of the advertising firms to protect the collected information has not been employed. Adblocking software and browser extensions are still the best practice to date. Unfortunately, they’re still not consistent or developed enough to fully protect users from novel Adfections.
Alternatively, flip phones are gaining popularity and would be an option for those who want out of the surveillance culture. Newer generation models are capable of running on 4G/LTE networks, unlike the older generation of cellphones running on 2G/3G which are no longer operational in many countries. Further research is needed and investigations are ongoing as the technology evolves. Ultimately, the best offense against mass data theft will always be the best defense.
Via TechRadar and CitizenLab
By Heather Jackson