Targeted Ads Used to Deliver Spyware: US Senators Call for Reform as Ad Industry Pushes Back

Two US senators say new research showing that online targeted advertising can be used to spread spyware highlights the need for better security in the advertising industry. Some of the advertising businesses named in the research, however, believe their current practices are adequate.

The Citizen Lab at the University of Toronto, working with cybersecurity and ad-tech firm Confiant, published a report on AdFection. This technique used targeted ads to deliver zero-click mercenary spyware, meaning the infection did not require the victim to click on anything. The report says ad vendors must significantly strengthen their cybersecurity and threat detection to cut off malicious advertisers across the supply chain. It also says they should regularly vet, screen and audit their business partners and hold them accountable for their own supply chains.

Senators Ron Wyden and Cory Booker, both Democrats, introduced legislation in 2023 to ban advertising networks from using personal data for targeting, but it never advanced beyond introduction. Booker said Americans need much stronger privacy protections. Wyden, who has called adtech a national security threat, was concerned that ads from Discover-Tech, the company most linked to AdFection, reached government networks. He said allowing targeted ads on government devices is an open invitation to spies and criminals.