AdFection
An attack method that delivers spyware through online advertising networks. It abuses the legitimate mechanisms of programmatic advertising, such as RTB bidding, creative rendering, and redirect chains, to trigger a zero-click attack during the ad rendering stage, without relying on a specific CVE vulnerability.
Timeline (last 90 days)
Citizen Lab publicly confirmed for the first time that mercenary spyware can be spread through targeted ad delivery, and named the technique AdFection.
Traditional malvertising usually relies on a user clicking and then being redirected to a malicious page or exploiting an outdated plugin vulnerability, whereas the key difference of AdFection is that the attack is fully triggered at the ad rendering stage, requiring no interaction from the user.
AdFection's trigger mechanism involves the abuse of browser APIs during the ad rendering process rather than relying on patched CVE vulnerabilities, so the attack surface still exists even if the user's browser is the latest version.
Traditional zero-click attacks mostly rely on unpatched remote code execution vulnerabilities in the operating system or browser (such as iMessage's FORCEDENTRY), whereas AdFection does not rely on a specific CVE and instead abuses browser API behaviors permitted by the advertising standard itself.
Ad blockers (such as uBlock Origin and AdGuard) mainly rely on domain blacklists, element hiding rules, and heuristic filtering, but AdFection delivers through legitimate ad network domains, which have good reputations and are not on blacklists, making it difficult for blockers to stop.
The emergence of AdFection means that spyware delivery methods are evolving from induced clicks toward imperceptible delivery, traditional security alerts based on user behavior basically become ineffective, and security practitioners need to bring the ad supply chain into their threat models as a key attack surface to proactively monitor.
All Facts (6)
Citizen Lab publicly confirmed for the first time that mercenary spyware can be spread through targeted ad delivery, and named the technique AdFection.
50%UnverifiedTraditional malvertising usually relies on a user clicking and then being redirected to a malicious page or exploiting an outdated plugin vulnerability, whereas the key difference of AdFection is that the attack is fully triggered at the ad rendering stage, requiring no interaction from the user.
50%UnverifiedAdFection's trigger mechanism involves the abuse of browser APIs during the ad rendering process rather than relying on patched CVE vulnerabilities, so the attack surface still exists even if the user's browser is the latest version.
50%UnverifiedTraditional zero-click attacks mostly rely on unpatched remote code execution vulnerabilities in the operating system or browser (such as iMessage's FORCEDENTRY), whereas AdFection does not rely on a specific CVE and instead abuses browser API behaviors permitted by the advertising standard itself.
50%UnverifiedAd blockers (such as uBlock Origin and AdGuard) mainly rely on domain blacklists, element hiding rules, and heuristic filtering, but AdFection delivers through legitimate ad network domains, which have good reputations and are not on blacklists, making it difficult for blockers to stop.
50%UnverifiedThe emergence of AdFection means that spyware delivery methods are evolving from induced clicks toward imperceptible delivery, traditional security alerts based on user behavior basically become ineffective, and security practitioners need to bring the ad supply chain into their threat models as a key attack surface to proactively monitor.
50%