»Adfection« | Hardly any protection possible: Internet advertising is becoming the new weapon for interception

An infection using “adfection” can occur without any click from those affected. It is enough for certain advertising to appear on the screen once. Photo: dpa/Jan Woitas The Citizen Lab research institute at the University of Toronto says it has technically proven for the first time that companies use targeted advertisements to install spy software on smartphones. This infection can occur without any interaction from those affected - clicks on links or images are no longer required. The researchers refer to this “zero click” method as “adfection”.

This became known as part of research into the Israeli company Discover-Tech Ltd., which claims to be a provider of digital advertising on the Internet. But according to Citizen Lab, it acts as an intermediary between the advertising industry and the market for commercial surveillance software.

An attack using this new method works via advertising banners, which are common on websites and in free apps. Technically speaking, these are so-called real-time auctions (real-time bidding) that run in the background: As soon as a person opens an app or accesses a website, a type of auction is started in the background in which advertising networks automatically place bids for the free space within milliseconds.

So that the bidder's software can decide whether it is worth it, data about the device and the user is transmitted with each request, including advertising ID or cookie identifiers, approximate location, IP address and information about the page visited.

Despite the flood of data, it is possible to select individual devices to display advertising - artificial intelligence probably also helps with this. According to the researchers, Discover-Tech uses its own platform called Controlium. When an ad was delivered to a device that was to be infected, the embedded code called a server owned by the Israeli company. Based on the IP address and advertising ID, this decided whether the device should reload malware via a detour.

For the infections, Discover-Tect apparently works with other relevant spy companies from Israel, including the Intellexa consortium, whose Trojans the Greek government used to trigger a wiretapping scandal in 2022. With such malware, authorities or other attackers can remotely search the entire device for content, read communications and activate microphones or cameras on the cell phone.

Citizen Lab's forensic research also determined that 45 devices, including computers, from the Qatar-based international Arabic news channel Al Jazeera were attacked with Candiru spyware. The company, which was also once based in Israel, has been on a US Department of Commerce sanctions list since 2021. Candiru is said to have sold spyware to foreign governments who used it to spy on government officials, journalists and activists.

Possibly to avoid the sanctions, the company was taken over by a US company in 2024 and now operates under the name Integrity Labs.

By evaluating around four billion real-time bidding records, the researchers in Canada were also able to determine that Discover-Tech served ads connected to its servers on at least 120,000 websites and over 75,000 mobile apps, including the messaging app Viber, the language learning app Duolingo and news websites. According to the report, some of the advertisements delivered bore the markings of well-known brands such as Amazon and Ali Express - but probably without the companies' knowledge.

However, it is unclear in how many cases malicious software was reloaded. According to Citizen Lab, the Discover Tech ads were also played on networks of governments, militaries and international organizations, including NATO and the International Criminal Court, the European Parliament and several ministries. It was also not possible to prove whether infections occurred there.

Discover-Tech was a well-known company in the advertising industry for years. Inclusion in lists of certified providers by Google and the European industry association Interactive Advertising Bureau made access to commercial advertising networks easier. That's over for the time being: According to Citizen Lab's research, both organizations removed Discover-Tech from their lists, and Google even blocked all access to its advertising platforms.

It is hardly possible to defend yourself against clickless infections via advertisements and commercial tracking on the Internet - other than to consistently block them, both in the browser using add-ons and at the network level. The Citizen Lab also recommends this. Deactivating the advertising ID in the mobile phone operating system is also mentioned as a building block for greater security.

However, complete advertising blocking within apps or smart TVs can only be carried out by the providers themselves. The researchers are therefore calling for legal restrictions on the sharing of personal data in real-time auctions for advertising.

Citizen Lab's research does not contain any information about which police or secret service agencies procure and use products like those from Discover-Tect. Research by netzpolitik.org has made this known about German criminal investigation offices. The use by the US migration police ICE, which obtains location data from migrants' smartphones via commercial data from real-time bidding systems, has also been well researched.

ICE is of the opinion that this new form of surveillance does not require a court order: those affected would have given their consent to the terms of use for the advertising companies if their data were to be resold.

With us, no one has to pay to be informed. Sounds like a bad business model? It is too. But independent journalism and participation for everyone are more important to us than profit. Journalism still costs money: research, printing and all the people who do it. That's why we depend on you. We need 300,000 euros by the end of the year.

Donate once or regularly, every amount counts. So that nd remains.