Ad networks weaponised: New 'AdFection' spyware targets devices

Cybersecurity researchers at Citizen Lab have identified a concerning surveillance threat spreading through the pipes of digital marketing. Dubbed "AdFection", the newly highlighted spyware strain infects both mobile devices and personal computers by leveraging standard global online advertising networks.

The technique, commonly referred to as malvertising, subverts the normal digital browsing experience. Rather than relying on traditional social engineering—such as tricking a worker into downloading an attachment from a suspicious email—the threat actors purchase or inject malicious code directly into commercial ad networks. As these digital banners and widgets load on regular websites, they silently trigger exploits aimed at taking control of the visiting device.

The hidden risks of routine browsing

For most companies, standard security advice focuses on teaching employees to spot suspicious emails and avoid untrusted software downloads. However, intrusions routed through normal advertising pipelines bypass that playbook entirely. An employee carrying out routine work research on a well-known industry blog or news portal could theoretically be exposed to spyware simply by loading an affected page, without ever clicking on a dodgy link.

While full details regarding the ultimate origin and targets of the campaign continue to emerge, the discovery highlights persistent security flaws across the programmatic advertising supply chain. Because automated exchanges broker billions of ad impressions every second, detecting malicious code hidden within seemingly legitimate marketing scripts remains an uphill battle for ad networks—and a convenient delivery mechanism for determined attackers.