Last week Citizen Lab, the research group at the University of Toronto that tracks surveillance tools, published a report on something it calls AdFection. It is spyware. What makes it different from the usual kind is how it gets onto your phone. You don’t click a link or open a file. An ad loads on a page you are reading, and that is enough.
Engadget’s write-up has the numbers. The company behind it, an Israeli firm called Discover-Tech, presented itself as an advertising business. According to the report it displayed 442 million ads across more than 120,000 websites, including the BBC and the New York Times, and inside apps like Duolingo and Grindr. The targets were journalists, staff at NATO and the European Commission, and people at Nvidia and Arm. Google has since blocked the firm from its platforms after a joint investigation with Citizen Lab and Confiant.
If you work in media buying, the detail that should stop you is not the spyware. It is the mechanism.
It used the same auction you use
Every time a page with programmatic ads loads, an auction runs in a few milliseconds. The page offers up a slot and some information about the person looking at it, buyers bid, the winner’s ad appears. That is real-time bidding, and it is how most display advertising is bought now, including the display we run for clients.
Discover-Tech didn’t hack that system. It used it as designed. The report says the firm used the bidding process to profile and de-anonymise specific people, then won the auction to show them an ad, and the ad carried the code. The same machinery that lets a brand reach “people in Manchester who looked at running shoes” let a surveillance company reach “this particular person at the European Commission”.
That is the bit I keep coming back to. The targeting worked exactly as advertised. It was just pointed at someone.
What brand safety was looking at
Most brand safety spend in this industry goes on checking the page. Is the article about terrorism, is the video a hoax, is the site a made-for-advertising farm. Those are reasonable questions, and the tools answer them well enough.
None of them look at the ad next to yours. None of them look at who else won an auction on the same page, or what their creative actually contained. Your pre-roll on a BBC article was safe by every measure we use, and the display unit below it was delivering spyware to the person reading. The page was fine. The pipe was not.
I don’t think the brand safety vendors are to blame for that. They sold what the market asked for, which was protection against embarrassing adjacency. The market never asked whether the exchange itself could be used as a weapon, because nobody had shown that it could. Now somebody has.
The question to ask your buyer
The honest answer to “where does my money go” in programmatic is still, for most advertisers, a shrug. There is the agency, then the demand platform, then one or several exchanges, then the supply platforms, then the publisher. Each one takes a cut and each one is a place where something you didn’t buy can sit next to the thing you did.
The fix is not to stop buying programmatically. The same auction is about to get a new buyer in ChatGPT, which I’ve written about in ChatGPT ads will take your customer list, and the supply chain question applies there too. It is one of the few channels that can reach a specific audience at a sensible price, and the alternative is paying rate card for a homepage takeover. The fix is to shorten the chain. Fewer exchanges. Direct deals with publishers you actually want to be on. Supply path reporting that names every intermediary, which the good platforms will give you if you ask and the bad ones will explain is very complicated.
Citizen Lab’s senior researcher, Bill Marczak, told the Financial Times the firm had been using the advertising system this way for years, turning trusted sites into a delivery platform. Years. This was not a clever new trick that got caught quickly. It ran, on the pages your brand was paying to appear on, for a long time.
Your logo was on that pipe. The money you spent to keep it safe was looking at the article.