How AdFection Weaponizes Programmatic Advertising for Zero-Click Exploitation

The offensive problem AdFection solves

Commercial spyware operators face two separate technical problems: finding the target's device and exploiting the target's device. These have traditionally been addressed independently. Finding the device might involve phishing to discover an IP address, network injection to intercept traffic, or social engineering to learn which services the target uses. Exploiting the device requires a vulnerability and an exploit chain, which are expensive to acquire or develop.

AdFection's offensive innovation is that it uses the advertising ecosystem to solve the first problem at scale. An advertising identifier can persist across many applications and services, which means the operator can track a target's device as it moves between apps, websites, and networks. The operator can answer questions like: Is this target online? Which IP is the device currently using? Which application is being used? Which browser or device model is active? Where is the device geographically? Can I deliver JavaScript to it?

Only once those conditions look favorable does the attacker expose the expensive exploit. This is excellent operational security for a spyware operator because it means the zero-day exploit, which may cost hundreds of thousands or millions of dollars, is only deployed against a confirmed, validated target rather than wasted on a scanner or an uninteresting device.

Real-time bidding as an attack surface

Real-time bidding, or RTB, is the automated auction process that occurs in milliseconds when an ad impression becomes available. A website or app requests an ad, and multiple advertisers bid on the impression based on the available targeting data. The winning ad is then loaded and displayed.

From an offensive perspective, RTB is an attack surface because it exposes device information to potential bidders, and it allows an attacker with adtech infrastructure to participate in the auction and win impressions associated with a specific target. Discover-Tech's infrastructure could participate in the auction and recognize a desired target using identifiers such as IP address, mobile advertising ID, advertising cookie ID, browser identifiers, device characteristics, and geographic information.

The key offensive property of RTB is that the victim does not choose to interact with the attacker. The victim is simply using their device normally, and the advertising system brings the attacker's code to them. This is fundamentally different from phishing, where the victim must click a link, or watering hole attacks, where the victim must visit a specific compromised site. With RTB-based delivery, any app or website showing programmatic ads can become the attack vector.

Selective JavaScript delivery and exploit cloaking

The most operationally significant offensive technique in AdFection is selective execution. When the ad loads, it requests JavaScript from Discover-Tech infrastructure. Non-targeted users frequently receive no additional malicious JavaScript. The system evaluates the request against the targeting criteria and only returns the next-stage payload if the device matches.

This is exploit cloaking. A security scanner that fetches the same ad creative sees benign or empty content because its device characteristics, IP address, or location do not match the targeting criteria. The actual target, however, receives the full attack chain. Eskimi confirmed that creatives returned different code depending on device, IP address, and location, and that campaigns sometimes targeted extremely narrow IP ranges.

The offensive advantage is clear. Traditional exploit delivery serves the same payload to everyone who visits the URL, which means security researchers, scanners, and sandboxing systems all see the same malicious content and can analyze and block it. With selective execution, only the specific target device sees the attack, which dramatically reduces the exposure of the exploit to defensive analysis.

The ECDH JavaScript C2 layer

Confiant's analysis of the AdFection infrastructure uncovered a JavaScript system that masqueraded as an ordinary verification and analytics SDK. The obfuscated JavaScript established an ECDH-derived shared secret with operator infrastructure and then polled the server for further instructions.

ECDH, or Elliptic Curve Diffie-Hellman, is a key agreement protocol that allows two parties to establish a shared secret over an insecure channel. By using ECDH, the JavaScript C2 layer ensures that the communication between the compromised ad context and the operator's server is encrypted with a key that only the two parties know, which means network inspection cannot read the tasking or payload data.

This provides several offensive advantages: encrypted tasking that resists network-level detection, flexible infrastructure that can rotate servers without breaking the key agreement, selective payload delivery that only decrypts for the intended target, and reduced exposure to scanners that would see only encrypted polling traffic rather than readable commands.

Why traditional defenses fail against AdFection

Traditional anti-phishing training fails because there is no link to click and no message to scrutinize. Traditional network monitoring may not flag the traffic because it goes to legitimate-looking advertising infrastructure. Traditional endpoint detection may not trigger because the initial JavaScript execution occurs in the browser context, which is a normal activity.

The attack chain only becomes visible at the point where the Candiru validator is contacted and, subsequently, where the DevilsTongue implant begins operating. By that point, if the exploit chain has succeeded, the implant is already running with kernel-level privileges and actively evading detection.

This is why Citizen Lab's defensive recommendation is unusually strong: block advertisements at the organizational gateway for high-risk environments. The reasoning is that targeted advertising should now be treated as an active attack surface, not just a privacy concern. For high-value targets, the most effective defense is to prevent the advertising infrastructure from reaching the device at all, rather than trying to detect the attack after it has been delivered.

Frequently asked questions

Related research