AdFection malware campaign exploits behavioral ad tech to deliver zero‑click spyware

What happened

Researchers at Citizen Lab disclosed a new malware campaign, AdFection, that uses ad‑network JavaScript to deliver zero‑click spyware to journalists. The attack leverages tracking identifiers and real‑time bidding to target devices without user interaction. EFF recommends device hardening, tracking‑blocking extensions, and disabling mobile advertising IDs.

Why it matters for trust and compliance

• Its status is published. It is enacted but may not be in force yet. Check the effective date before planning around it.
• The report highlights how ad‑tech can be weaponized for spyware, underscoring urgent privacy and security risks for high‑risk users.

Who is affected

Recommended actions

1. Review consent, cookie and tracking practices against the requirement.
2. Check that privacy notices describe the practices this addresses.
3. Inventory where this data is shared or sold and whether opt-outs are honoured.
4. Map the security requirements to existing controls and close gaps.