Is your mobile data being harvested by ad network spyware?

Mobile users in dozens of countries are facing silent surveillance through a flaw in the digital advertising supply chain. Researchers at The Citizen Lab identified a campaign dubbed AdFection, which allows attackers to collect data and install spyware without any user interaction. This zero-click method exploits the real-time bidding systems that power online ads, turning standard ad displays into infection vectors for mercenary spyware operations.

The primary actor behind this activity is Discover-Tech, which operates the Controlium platform. According to The Citizen Lab, this tool enables cybercriminals to precisely profile and de-anonymise millions of users. The system fingerprints devices and automatically infects them when an ad is rendered on screen. This process occurs in the background, meaning victims are often unaware their movements and data are being tracked.

How the attack bypassed security checks

Discover-Tech successfully masqueraded as a legitimate advertising company within the online sales environment. The researchers noted that the firm was listed as a certified and approved vendor by major industry bodies, including Google and IAB Europe. This status allowed its malicious code to be distributed through trusted networks such as Google, Yandex, and Beeswax. The actor even exploited European General Data Protection Regulation consent frameworks to specifically target victims within the EU.

Who is affected by this campaign

The scope of the exposure is significant, with ads displayed on nearly 200,000 unique websites. The campaign also reached Android and iOS applications across dozens of nations during a four-month period. Any user who viewed these ads on their mobile device potentially had their device fingerprinted and infected. The structural flaws in the advertising system failed to detect this abuse, allowing the mass privacy invasion to proceed undetected for months.

Our take on the response

The Citizen Lab researchers disclosed their findings to Google, IAB Europe, Beeswax, Vungle (Liftoff), and Eskimi. All these entities took action to disconnect Discover-Tech’s access to the digital advertising ecosystem. The researchers warned that this incident illustrates deep structural flaws in the online advertising system. They stated the system failed to detect or prevent the abuse, suggesting that similar actors may still operate within unmonitored sectors of the real-time bidding market.

What affected people can do

Security teams should review ad integration logs for unusual traffic patterns or unknown vendors. Users should check their device permissions and look for apps that request excessive access without clear justification. It is advisable to use privacy-focused browsers or ad blockers to reduce exposure to real-time bidding networks. Monitor bank statements and account activity for signs of compromise, as spyware can harvest credentials. Be wary of follow-up phishing attempts that may use stolen personal data to appear legitimate.