“The report underscores the growing risk of spyware and the increasingly sophisticated methods used to track and target people online,” Sen. Cory Booker said in a statement to CyberScoop. “Americans need vastly stronger privacy protections that stay ahead of these evolving surveillance threats.”
The Citizen Lab and Confiant: AdFection, zero‑click spyware delivery
The Citizen Lab at the University of Toronto, working with the cybersecurity and ad‑tech firm Confiant, published a report documenting a technique it calls “AdFection,” in which targeted online ads delivered zero‑click mercenary spyware. The report said ad vendors must “significantly level up their cybersecurity and threat detection capacity to effectively cut off malicious advertisers across the supply chain,” and that vendors should “rigorously and regularly vet, screen, and audit their business partners and hold them accountable for their own supply chains.”
Citizen Lab criticized what it called “a dangerous lack of due diligence” and “broken digital infrastructure,” concluding the sector needed to “get serious” about security. The report also recommended that ad vendors better share threat data, improve partner vetting, audit vendor registries, and “ban vendors by default in jurisdictions known to be permissive of abuse.”
Discover‑Tech and Candiru: the specific allegations
The report links a company called Discover‑Tech to the AdFection technique and says the spyware firm Candiru infected users “through Discover‑Tech online ads.” Discover‑Tech, the report notes, had impressions on government networks and appeared on lists of “certified” and “approved” vendors that Google and IAB Europe maintained.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleSenators press for stronger limits and action
Sens. Ron Wyden and Cory Booker — who together introduced 2023 legislation to ban advertising networks and facilitators from using personal data to target, legislation that “never advanced past introduction” — said the Citizen Lab report underlines the need for industry reform. Booker framed the findings as proof that Americans need stronger privacy protections; Wyden called adtech “a national security threat,” saying in a statement to CyberScoop that “Allowing targeted ads on government devices is an open invitation to spies and criminals. It’s the digital equivalent of leaving all the doors and windows unlocked at a sensitive government facility.”
Wyden added that “advertising exchanges are not meaningfully protecting users against malware and location tracking,” and said he has urged the government to disable ads on government browsers, turn off mobile ad IDs, and pushed his bill to ban all targeted advertising.
Industry responses: bans, denials, and differing interpretations
Google participated in the Citizen Lab and Confiant investigation and, according to a company spokesperson quoted by CyberScoop, “banned Discover Tech during a joint investigation with Citizen Lab and Confiant.” Google said it “continuously blocked malicious ads to help people stay protected while we dismantled the network,” and noted its automated systems “detected over 99% of policy‑violating ads before reaching users last year.” The company also said that banning a vendor entirely required proof linking its ad infrastructure to spyware and that it regularly audits participants in its Authorized Buyer program.
IAB Europe did not respond to the report before publication but provided comments afterward. Lauren Wakefield, marketing and communications director for IAB Europe, said: “The findings do not demonstrate that the digital advertising infrastructure is broken, but rather point to the potential misuse of existing technologies and functionalities that are not specific to digital advertising but inherent to web technologies.” She emphasized that “the investigation of potentially unlawful activities, such as the deployment of spyware, ultimately falls within the remit of competent authorities,” and argued that cybersecurity measures should be proportionate to risks faced by individual companies.
Separately, the ad networks Beeswax, Vungle and Eskimi took steps to remove Discover‑Tech’s access to the digital advertising ecosystem, according to the Citizen Lab report. Microsoft — which owns the ad system Xandr — did not respond to the report and also did not reply to CyberScoop’s requests for comment.
What this means for government devices, ad vendors, and regulators
- Government devices: Lawmakers have highlighted ads reaching government networks as a particular risk; Wyden has urged blocking ads on government browsers and disabling mobile ad IDs. Several U.S. agencies have already “taken steps to block ads” or recommended blocking them for federal users, the reporting says.
- Ad vendors and platforms: Citizen Lab called for stronger vetting, shared threat intelligence, and vendor registry audits; Google says it continuously blocks malicious ads and audits Authorized Buyer participants, while some ad platforms moved to revoke Discover‑Tech access.
- Regulators and prosecutors: The report urged regulators to investigate Discover‑Tech and Candiru, to scrutinize the advertising ecosystem for other potential espionage uses, and to consider sanctions against mercenary spyware firms and enabling companies.
The report and the responses it generated set up a clear, near‑term clash over responsibility and enforcement: researchers and two senators are calling for stricter controls and regulatory inquiry, some ad platforms point to automated defenses and selective bans, and a set of enforcement questions — about vetting, vendor certification, and when to remove vendors permanently — remain disputed. CyberScoop’s coverage of the findings and the industry responses is available at the original link below.
