How AdTech Is Being Weaponized for Surveillance and Zero-Click Spyware Attacks
Summary
Sekoia examines how commercial surveillance firms exploit real-time bidding and app SDKs for mass profiling, targeted geolocation, and ad-delivered spyware, and discusses the technique’s limitations and growing regulatory scrutiny.
Key points
- Real-time bidding broadcasts user location, device identifiers, and inferred interests to many bidders, potentially enabling data collection even by companies that lose the auction.
- Third-party SDKs can collect identifiers and behavioral data across apps and may inherit permissions granted to the host app.
- The report distinguishes passive ADINT for group profiling, active ADINT for near-real-time tracking of identified devices, and offensive ADINT for ad-delivered spyware.
- Examples of offensive capabilities include Intellexa’s Aladdin and Insanet’s Sherlock, described as using advertising delivery to enable zero-click infection.
- The report identifies commercial surveillance vendors and data brokers using ADINT, including Babel Street, ISA Security, Rayzone, and Intelos.
- Data accuracy varies, while integration costs, regulatory scrutiny, and export controls can constrain ADINT operations.
Article Details
- Attack Vectors
- Real-Time Bidding (RTB) bid requests expose user location, device identifiers, and behavioral attributes to multiple bidders, enabling passive profiling even when a bidder does not win the auction.
- Third-party SDKs collect device identifiers and behavioral or location data through host-application permissions, enabling continuous or on-demand tracking.
- Active ADINT uses a known Mobile Advertising ID (MAID) and configured geofences to surface near-real-time location signals from RTB bid opportunities.
- Offensive ADINT uses RTB ad delivery to display malicious advertisements that exploit software vulnerabilities and install spyware without user interaction.
- The article reports that Intellexa's Aladdin targeted devices identified by IP address, and that Insanet's Sherlock was an ad-based infection vector associated with Candiru's DevilsTongue spyware.
- Defensive Notes
- Supply-Side Platforms (SSPs) bear responsibility for auditing ad content and can terminate relationships with actors identified as malicious.
- The article calls for greater governance of commercial intrusion tools and scrutiny of applicable dual-use export controls.
MITRE ATT&CK
T1189 · Drive-by CompromiseThe article describes zero-click compromise through a malicious advertisement displayed via the advertising delivery process.T1203 · Exploitation for Client ExecutionOffensive ADINT exploits software vulnerabilities through delivered advertisements to install spyware on target devices.
People
Malware
DevilsTongueinfection vector subsequently reported by Haaretz in 2023 and identified as bundled with Candiru's DevilsTongue spyware.Pegasuson WhatsApp messaging service, used as a zero-click intrusion vector to install the spyware Pegasus. The decision echoes Apple's lawsuit attempt against the same company in 2021, accusing NSO of usingPredatorwith the CSV Candiru as the provider of Sherlock, an AdTech-based delivery vector used to deploy the Predator spyware, an early documented instance of offensive ADINT.
Vendors
ARD Securityreceptive market. ISA Security has marketed Patternz since at least 2021, with commercial support from ARD Security, a business facilitator with reported connections in Singapore. The growing regional relevance ofBabel StreetThis business model is for instance commercialised through Locate X, a platform sold by the US company Babel Street which allows operators to track a target device by its MAID and geofence locations of interest usingCandiruan ad-based infection vector subsequently reported by Haaretz in 2023 and identified as bundled with Candiru's DevilsTongue spyware.Gravy AnalyticsAmong the first actors to develop such capabilities were PlanetRisk, Venntel (a subsidiary of Gravy Analytics), Babel Street, and Mobilewalla. Demand was notably driven primarily by US government agencies, whichInMobiAn early documented case of regulatory action in this space concerns InMobi, an Indian company charged by the FTC in 2016 for tracking individuals through AdTech mechanisms without consent. On the operational side,Insanetinto the RTB ecosystem to facilitate ad delivery. In a distinct but related case, Israeli company Insanet developed "Sherlock", an ad-based infection vector subsequently reported by Haaretz in 2023 andIntellexaTwo documented cases illustrate the operationalisation of this approach. Intellexa, whose infection vector catalogue was disclosed by Amnesty International, developed a capability designated "Aladdin", which leveragesIntelosBetween 2019 and 2023, the ADINT market expanded significantly beyond the United States, with a distinct cluster of Israeli companies emerging as key players. These include Rayzone, Intelos, ISA Security, and Insanet.ISA SecurityCommercial platforms already operationalise this capability: Patternz, marketed by the Israeli firm ISA Security, reportedly leverage RTB data to profile billions of users, including real-time location, movementMobilewallasuch capabilities were PlanetRisk, Venntel (a subsidiary of Gravy Analytics), Babel Street, and Mobilewalla. Demand was notably driven primarily by US government agencies, which have longstanding procurementMorningStar TECestablished corporate links between Intellexa and two advertising entities, Pulse Advertise and MorningStar TEC, suggesting deliberate integration into the RTB ecosystem to facilitate ad delivery. In a distinctNSO Group Technologies LimitedIn October 2025, a United States (US) court ordered the private company NSO Group Technologies Limited, referred to as ‘NSO’ in this report, to stop researching and leveraging vulnerabilities on WhatsApp messagingOutlogicand retrieving geolocation signals on demand. A documented example is X-Mode (later rebranded Outlogic), a US data broker whose location-collection SDK was embedded in widely distributed applications such asPlanetRisksharing common behavioural attributes. Among the first actors to develop such capabilities were PlanetRisk, Venntel (a subsidiary of Gravy Analytics), Babel Street, and Mobilewalla. Demand was notably drivenPulse AdvertiseRecorded Future further established corporate links between Intellexa and two advertising entities, Pulse Advertise and MorningStar TEC, suggesting deliberate integration into the RTB ecosystem to facilitate adRayzoneintelligence discipline. The concept was first introduced in 2015 in marketing material published by Rayzone, a US-based surveillance company, and has since established itself as a recurring keyword within theUberMediaapplications during this period. Developed in 2016 and drawing on data collected by the data broker UberMedia, Locomotive was used by the US Joint Special Operations Command to monitor the movements of ISIS forcesVenntelcommon behavioural attributes. Among the first actors to develop such capabilities were PlanetRisk, Venntel (a subsidiary of Gravy Analytics), Babel Street, and Mobilewalla. Demand was notably driven primarily byX-Modebypassing the RTB infrastructure and retrieving geolocation signals on demand. A documented example is X-Mode (later rebranded Outlogic), a US data broker whose location-collection SDK was embedded in widely
Products
AdHoctracking purposes. Reporting by Gur Megiddo in TheMarker indicated that Intelos was supplying its product AdHoc to Shin Bet for this purpose, while 404 Media referenced promotional material for Patternz, anotherAladdininfection vector catalogue was disclosed by Amnesty International, developed a capability designated "Aladdin", which leverages RTB processes to deliver a malicious ad to a target identified by its IP address.Echoin the Israel Directory 2018/2019 as a "Cyber Intelligence" provider, developed a solution designated Echo, described as a "Global Virtual SIGINT System" providing surveillance coverage of internet users. TheForceEntryThe decision echoes Apple's lawsuit attempt against the same company in 2021, accusing NSO of using ForceEntry, an exploit on iMessage also enabling zero-click intrusion. Locate XMAID and geofenced locations of interest. This business model is for instance commercialised through Locate X, a platform sold by the US company Babel Street which allows operators to track a target device by itsLocomotiveindividuals through AdTech mechanisms without consent. On the operational side, PlanetRisk's product Locomotive, later renamed VISR, illustrates the breadth of passive ADINT applications during this period.Patternzfrom ostensibly depersonalised identifiers. Commercial platforms already operationalise this capability: Patternz, marketed by the Israeli firm ISA Security, reportedly leverage RTB data to profile billions of users,Sherlockecosystem to facilitate ad delivery. In a distinct but related case, Israeli company Insanet developed "Sherlock", an ad-based infection vector subsequently reported by Haaretz in 2023 and identified as bundled withVISRAdTech mechanisms without consent. On the operational side, PlanetRisk's product Locomotive, later renamed VISR, illustrates the breadth of passive ADINT applications during this period. Developed in 2016 and drawing
Countries
Azerbaijanevidenced by the 2015 Hacking Team leaks, which identified Malaysia, Thailand, South Korea, Kazakhstan, Azerbaijan, and Uzbekistan as active customers of the RCS spyware, ADINT-based products found a receptive market.FranceIsraelRayzone, listed in the Israel Directory 2018/2019 as a "Cyber Intelligence" provider, developed a solution designated Echo, described as a "Global Virtual SIGINT System" providing surveillance coverage of internetKazakhstanvendors, as evidenced by the 2015 Hacking Team leaks, which identified Malaysia, Thailand, South Korea, Kazakhstan, Azerbaijan, and Uzbekistan as active customers of the RCS spyware, ADINT-based products found aMalaysiawith commercial surveillance vendors, as evidenced by the 2015 Hacking Team leaks, which identified Malaysia, Thailand, South Korea, Kazakhstan, Azerbaijan, and Uzbekistan as active customers of the RCS spyware,South Koreavendors, as evidenced by the 2015 Hacking Team leaks, which identified Malaysia, Thailand, South Korea, Kazakhstan, Azerbaijan, and Uzbekistan as active customers of the RCS spyware, ADINT-based productsSyriaUS Joint Special Operations Command to monitor the movements of ISIS forces and displaced populations in Syria, ostensibly under the cover of a humanitarian project. Concurrently, the Southern Poverty Law CenterThailandcommercial surveillance vendors, as evidenced by the 2015 Hacking Team leaks, which identified Malaysia, Thailand, South Korea, Kazakhstan, Azerbaijan, and Uzbekistan as active customers of the RCS spyware, ADINT-basedUnited StatesIn October 2025, a United States (US) court ordered the private company NSO Group Technologies Limited, referred to as ‘NSO’ in this report, to stop researching and leveraging vulnerabilities on WhatsApp messagingUzbekistan2015 Hacking Team leaks, which identified Malaysia, Thailand, South Korea, Kazakhstan, Azerbaijan, and Uzbekistan as active customers of the RCS spyware, ADINT-based products found a receptive market. ISA Security has