Citizen Lab Canada ran a full-scale investigation into the Israeli surveillance attack on Al Jazeera. This led to the discovery of Zero-Click Mercenary Ad Spyware. It’s basically adware that exploits a device even when the user didn’t interact with a malicious ad.
The so-called “Adfection” was targeted at hundreds of thousands of apps and websites across multiple countries. This is getting a lot of coverage in Pakistani media. Citizen Lab recorded at least 139 million impressions of such adware in Pakistan alone, and sadly, WhatMobile was reeled in as one of the platforms that served those infected ads. Our readers are understandably upset and likely want an explanation. So we’d like to clarify our position.
For the sake of full transparency, we want to get our side of the story across. We’d like to explain how automated web advertising works and what the Citizen Lab research actually established. We’ll also correct several misconceptions about the figures being cited in media reports.
What You’ll Learn:
- WhatMobile had zero involvement, and it wasn’t compromised in any way.
- The attack and how the blame can’t be pinned on a single party.
- WhatMobile notes that impressions don’t necessarily mean infection.
- Setting the Record Straight, Understanding the Numbers
Media Summaries of Citizen Lab’s report, especially in Pakistan, have misunderstood the volume of ad impressions on WhatMobile. We’d like to show you the exact details from the published research, so there’s no room for confusion.
That 100,000 figure is an aggregate. The report actually reads “more than 100,000 of those ads were shown on news publications and other popular sites from Montenegro (dan.co.me, vijesti.me), Yemen (adngad.net), and Pakistan (whatmobile.com.pk).”
Clearly, this 100,000 is a combined total across multiple international websites. WhatMobile’s actual share might only be a small portion of that overall sum, maybe in the hundreds. We'll request the missing data from Citizen Lab for clarity.
As to why WhatMobile was named? Zero Click adware by design was made to target media publishers, just like Al Jazeera. We are one of Pakistan’s most popular technology and mobile news publications. WhatMobile was cited by name just as an example of a high-traffic publisher. There’s no specific breakdown data or table attributing all 100,000 impressions to our platform alone.
And we need some perspective on the scale of this attack. Discover-Tech’s raw bids in Pakistan were roughly 139 million. Not all bids were won. That combined 100,000 figure across all affected regional sites is just 0.07% of the activity, and that activity is controlled and monitored by Google, not WhatMobile.
Programmatic Automated Advertising: How it works and How it was Exploited
Sites don’t actually store or serve ads by themselves. Publishers of those websites leave a block or space on the page, and Google places ads in those code blocks. Google has automated systems that determine in real time which ad is safe and should appear to an individual visitor.
Those are targeted ads, and they follow the device, not just the website. We use Google AdSense, and it actually serves ads dynamically based on a user’s unique device footprint, searches, or browsing history to know your interests. A visitor who saw a specific ad while checking phone specs on WhatMobile likely encountered the exact same ad on other news or entertainment websites during the same session.
Because ads are served at the individual level, based on individual interest, WhatMobile can’t possibly track what’s being served to each reader, be it a sports ad or an infected AliExpress ad. And Google actually took responsibility for it. This came straight from a Google Spokesperson when interviewed by WIRED on October 15th;
“Following a joint investigation with Citizen Lab and Confiant, Google blocked Discover-Tech from our ad platforms for systematically violating our policies.”
As to how the exploitation happened. Discover-Tech posed as a seemingly innocent company that was bidding on ad blocks to serve its own malicious zero-click spyware. They won some bids and were able to put those ads on local government websites and publications on a grand scale. WhatMobile servers were not infected, and the codebase remained completely secure and uncompromised. Google’s automated real-time bidding (RTB) system for ad allocation was exploited, not WhatMobile. As Google said, this operation was halted. Discover-Tech was banned from the ad distribution. So you are safe.
What the Citizen Lab Research Establishes (and What It Doesn't)
Automated digital ad infrastructure has a loophole. This isn’t news to anyone. Malicious actors have once again exploited automated ads, and this time they injected something much worse than your typical adware. This is a systematic issue. Citizen Lab actually found similar infected ad placements across major international outlets like BBC, CBC, The New York Times, etc. And it’s not their fault either. Regulating ads is Google’s responsibility, not the platform’s.
By the way, there were no allegations of wrongdoing. Citizen Lab‘s research had no findings that WhatMobile participated in, supported, or even had any knowledge of the surveillance operation through ads. And WhatMobile denies any and all allegations coming from local media outlets.
Another claim made by Citizen Lab explicitly clarified that an ad impression alone doesn’t mean a device got infected. This is intentional, and it only happens to targeted users, not everyday citizens. This calls for concern, yes, but you can catch the infected ads anywhere online through AdSense.
Message to our Readers
To our readers, you deserve clarity and security. Thousands of global and regional websites were injected with spyware via programmatic ads, and WhatMobile may have had the misfortune of being among them. But this shouldn’t be interpreted as our participation in this operation. We condemn the malicious actors behind this attack. And we call on major Ad exchanges like Google AdSense to tighten their ad pre-screening. They should immediately inform the platforms of a deceptive ad, so necessary actions can be taken in time. Since Google barred Discover-tech from its ad network, publications have safely reverted to their routines. All our readers can safely browse phone prices and specs on WhatMobile.com.pk.
