Real-Time Bidding and AdFection: How Programmatic Advertising Became a Spyware Attack Surface
Real-time bidding (RTB) is the millisecond auction process by which programmatic ad inventory is bought and sold. Each bid request exposes device metadata — IP, device type, OS, browser, app identifier, and advertising identifiers — to bidders. AdFection weaponizes this metadata to select and route targets through advertising infrastructure.
- Published
- 2026-10-15
- Last reviewed
- 2026-10-18
- Last updated
- 2026-10-18
- Evidence
- CONFIRMED
RTB from first principles
When a user opens an app or webpage, an ad exchange generates a bid request containing metadata about the opportunity. Demand-side platforms evaluate the opportunity on behalf of advertisers and submit bids; the auction is settled in milliseconds and the winning creative is delivered to the device.
System architecture: the distributed kill-chain
The AdFection pipeline operates on a six-stage continuous feedback loop. The ad network does not just deliver an ad; it acts as a global reconnaissance sensor that triggers the spyware only when a specific set of cryptographic and environmental conditions are met. Each stage feeds telemetry back into the targeting platform, refining who is selected for the next impression.
The transport layer: weaponizing the OpenRTB protocol
To understand why AdFection is so difficult to detect, you must understand the mechanics of the OpenRTB (Real-Time Bidding) protocol, which underpins an estimated 90% of the web's digital advertising.
2.1 The auction mechanics
When a user loads a page with an ad slot, the publisher's ad server issues a bid_request to multiple Demand-Side Platforms (DSPs). The bid request is a JSON payload containing massive amounts of device and user telemetry.
{
"id": " REQ-████████████",
"imp": [{ "id": "1", "banner": { "w": 320, "h": 50 } }],
"device": {
"ua": "[REDACTED]",
"ip": "[REDACTED]",
"os": "[REDACTED]",
"osv": "[REDACTED]",
"ifa": "[REDACTED]"
},
"user": { "id": "[REDACTED]" },
"geo": { "country": "[REDACTED]" },
"app": { "id": "[REDACTED]", "name": "[REDACTED]" }
}2.2 The delivery vector
The bid_response returned by Discover-Tech (the DSP) contains the winning ad. In AdFection, the adm (ad markup) field contains a redirect chain or an iframe that executes the malicious JavaScript.
Why this bypasses perimeter defenses: The victim's browser initiates a legitimate HTTPS GET request to the ad loader. To the victim's firewall or EDR, this looks exactly like a user interacting with a standard, highly-rated third-party ad network. It requires no special privileges, no email parsing, and no local file download (initially).
Normal RTB flow
Weaponized RTB / AdFection flow
Security-relevant metadata
- IP address
- Device type
- Operating system
- Browser
- Application identifier
- Approximate geography
- Advertising identifier (where available)
- Cookie identifiers
- Auction identifiers
The scale is central: Citizen Lab analyzed approximately 3.77 billion publicly exposed bidding records (March–June 2026), finding that Discover-Tech won roughly 442 million impressions (~11.7% of auctions) across 161 countries by IP geolocation, with ads containing attacker-related script tags displayed across 75,373 apps and 120,768 websites. Impressions reached sensitive networks including NATO, the UN, EU institutions, defense ministries, critical infrastructure, and major technology firms. See the Discover-Tech pillar.
Last updated 2026-10-18
