An ad no longer needs

For years, the industry has treated malicious advertising as a fraud and brand safety issue: fake traffic, scam ads and unsafe placements. New research shows the ad supply chain itself can be used to reach and compromise specific people, without anyone clicking anything.

What happened

On October 15, Citizen Lab reported that Discover-Tech, a company on Google's and IAB Europe's vendor lists since 2020, bought targeted ads to deliver mercenary spyware. When one of its ads loaded on a chosen device, that alone could start an infection. At least 45 devices at Al Jazeera were targeted.

Bid records from March to June show its ads appeared on nearly 200,000 apps and websites, bought through mainstream exchanges. Some of the ads used well-known retail logos without those brands' involvement.

Why it matters for brands

This isn't ad fraud, and brands' ads weren't the weapon. But it ran on the infrastructure brands use every day: the exchanges, the ID matching and the data inside every bid request. Routine scans missed it because the harmful code reached only the people being targeted.

Verification partners check where a brand's own ads run and whether real people see them. They don't screen the other buyers in the same auction. And when Citizen Lab's advice to people at risk is to block ads altogether, the trust that advertising depends on is at stake.

Four questions to ask your partners

1. Who do your partners let in?

Ask how your exchanges and SSPs vet the buyers they sell to, how often they review them, and what happens when a buyer is flagged. Approved status is where due diligence starts, not where it ends.

2. What does the auction expose?

Bid requests carry data about the people seeing ads, such as device and location signals. Ask your partners whether they limit that data to what's needed to run the auction.

3. What does verification cover?

Verification checks where your ads run. Ask your partners what screens the other ads that appear around yours, and how they detect harmful ads that target only a few people.

4. Is anyone watching for your brand?

Some of these ads borrowed well-known retail logos. Know who would spot your brand in ads you didn't run, and how quickly they could be taken down.

Ad security is now brand trust

Ad security belongs alongside brand safety and fraud prevention in partner selection, agreements and reporting. The brands in the best position will know how their partners protect the people seeing their ads, not only the ads themselves.

Questions to ask your team

• Which exchanges and SSPs carry most of our programmatic spend, and how do they vet buyers?

• Do our partner agreements address buyer vetting and harmful ads?

• What data about our audiences is shared in each auction, and is it more than needed?

• Who would know if our brand was used in an ad we didn't run?