AdFection: The new zero-click spyware hack hitting your phone via ads

The ultimate digital nightmare

Real talk: your daily scroll just got a lot scarier. Researchers at The Citizen Lab just dropped evidence of something called "AdFection," a zero-click hacking campaign that is straight-up terrifying. Unlike the usual phishing links where you have to be gullible enough to click, this malware infects your phone simply because an ad loaded on your screen. You won't see anything wrong, you won't click anything, and you definitely won't get a notification. It's giving "black mirror" vibes, but it's 100% real.

How it works

Basically, these bad actors are weaponizing the real-time bidding process that powers online ads. Every time you open an app or browse a site, an automated auction happens in milliseconds to show you an ad. The researchers found that an Israeli-founded marketing firm called Discover-Tech was allegedly using its platform to route users to servers linked to the spyware developer Candiru.

Between March and June of this year, ads linked to Discover-Tech showed up on over 70,000 mobile apps and 120,000 websites. The target list was high-stakes, too: researchers confirmed 45 devices belonging to Al Jazeera were targeted. It even appeared on networks for NATO, the UN, and government agencies across Europe and Australia.

Who's doing something about it?

Google has officially blocked Discover-Tech from its ad platforms after teaming up with Citizen Lab and the security firm Confiant to verify the threat. IAB Europe and Beeswax have also cut ties with the company. But here is the major L: experts say it is incredibly hard to stop this because the ad ecosystem is so massive and poorly regulated.

Why it matters

This is a massive red flag for the entire internet. We've always known the ad-tech industry collects way too much data, but using that infrastructure to auto-install spyware is a whole new level of dangerous. As Bill Marczak, a senior researcher at Citizen Lab, put it, "The risk of having your device infected with spyware simply by using a website or app that displays ads is a nightmare scenario." If you want to stay safe, highkey, your best move is using a serious ad-blocker everywhere you go. Stay vigilant.