Israeli Ad-Tech Firm Exploited Real-Time Bidding for Zero-Click Spyware Distribution
Translated & summarized from Bizportal by baba
An Israeli company, Discover-Tech, has been found to exploit real-time advertising systems to distribute zero-click spyware, according to a new study. The method, named AdFection, uses targeted advertising infrastructure to identify and infect specific individuals without user interaction. This sophisticated approach, which saw Discover-Tech involved in billions of ad attempts, bypasses traditional security measures and has led to the company being blocked by Google and suspended by IAB Europe. The findings highlight a new threat vector where advertising technology becomes a tool for espionage.
The story in 6 lines · by baba
- An Israeli company, Discover-Tech, used targeted advertising to distribute zero-click spyware, a first documented instance.
- The AdFection method exploits real-time bidding systems to identify and infect specific targets without user interaction.
- Discover-Tech's platform was involved in billions of ad attempts, appearing on over 120,000 websites and 70,000 apps.
- This technique combines the broad reach of advertising with the precision of commercial spyware for espionage.
- Google has blocked Discover-Tech from its ad platforms, and IAB Europe has suspended the company.
- Researchers warn this could be the start of a trend where spyware firms leverage ad tech for distribution.
A new study by Citizen Lab and cybersecurity firm Confiant has revealed that an Israeli company, Discover-Tech, exploited real-time advertising mechanisms to deliver spyware to targeted individuals without requiring any user interaction, such as clicking an ad or downloading a file. This marks the first public documentation of a commercial zero-click spyware distributed via targeted advertising, a method researchers have dubbed AdFection.
The AdFection system leverages the existing infrastructure of online advertising, which already collects vast amounts of user data, including device information, location, and browsing habits, to serve personalized ads. Discover-Tech's platform repurposed this capability to profile users, identify specific targets like journalists or government employees, and then deliver spyware to their devices. This approach is more sophisticated than traditional malvertising, as it filters millions of users to select a small number of high-value targets, making detection by security researchers more difficult.
Between March and June 2026, Discover-Tech participated in approximately 3.7 billion ad space acquisition attempts, securing around 442 million of them. Its ads appeared on over 120,000 websites and in more than 70,000 applications, often within legitimate services, allowing attackers to reach victims while they are using familiar platforms.
While zero-click attacks and malvertising are not new, the AdFection method represents a significant escalation by combining the broad reach of advertising networks with the targeted capabilities of commercial spyware. Previous zero-click attacks, such as those involving NSO Group's Pegasus and KISMET, have been documented, often targeting journalists and civil society members.
In response to the findings, Google has blocked Discover-Tech from its advertising platforms, and IAB Europe has suspended the company from its vendor list pending further investigation. Researchers warn that Discover-Tech may be the first example of a broader trend where spyware companies integrate with advertising systems to gain both target identification and distribution channels, posing a systemic threat beyond individual software vulnerabilities.
The same event, reported separately by each outlet. Open a few to compare what different newsrooms emphasize — and what they leave out.
Other 2
Not the same event — other stories that share this one’s people, places, or theme: background, reactions, and follow-ups.
