No click required: How the ad industry became a pipeline for mercenary spyware

What happened

Troublingly, Discover-Tech is successfully masquerading as a legitimate ad company across the online ad sales environment, the researchers said, listed as a “certified” and “approved” vendor by the likes of Google and IAB Europe. It could be tracking your movements and collecting your data, without you having to do a thing. Google is a software and Internet company based in Mountain View, and its products and services include Software tools.

This “zero-click mercenary spyware (software that secretly watches what a device is used for),” dubbed “AdFection,” is increasingly exploiting a sprawling online advertising ecosystem ripe for abuse, according to researchers at The Citizen Lab . One top actor in the space, Discover-Tech, runs the Controlium platform that allows cyber criminals to “precisely profile and de-anonymize” millions of users, fingerprint them, and automatically infect their devices when an ad is displayed.

Over a four-month period, the company’s ads were shown on nearly 200,000 unique websites and in Android/iOS apps in dozens of countries. Run by companies like Google, these take place “hundreds of billions” times a day, the researchers explained.