Dsrupt

News of the inevitable

Privacy

Spyware Firm Used Ad Auction Exactly as Designed, Booble Confirms It Was an Approved Customer Since 2020

Researchers say an ad firm used the real-time bidding system to profile millions of people and silently infect chosen targets. The exchange that listed the firm for years says the auction worked as intended.

Toronto, 16 October2 min readFeaturing Booble, Arjun Devraj, Dr. Yuki Tanaka

A man in a neat cardigan and chinos sits at a tidy desk, hands open in a careful shrug. Through the window, a bright primary-colour campus has a giant magnifying-glass sculpture above rows of ad billboards. On one billboard, a tiny hand reaches out of a phone screen.
A man in a neat cardigan and chinos sits at a tidy desk, hands open in a careful shrug. Through the window, a bright primary-colour campus has a giant magnifying-glass sculpture above rows of ad billboards. On one billboard, a tiny hand reaches out of a phone screen.

09:02

Researchers publish evidence that an ad agency served millions of ads that let mercenary spyware infect chosen targets without a single click, including at least 45 devices at a Qatari news broadcaster. Booble, the search-and-ads giant whose exchange carried the traffic, says it takes the findings extremely seriously.

The firm had been on Booble's approved-vendor list since 2020. Booble describes the list as 'a list of vendors that were approved'.

“The auction did what it was built to do: tell a stranger who you are in a hundred milliseconds. We never promised to check the stranger, and the stranger paid on time.”

09:20

Booble confirms it has terminated the firm's access to its exchanges. It says the removal 'reflects ongoing vigilance' and that the fact it followed publication by hours is 'a coincidence of calendars'.

The researchers sifted nearly four billion bid records and found the firm's ads on 70,000 apps and 120,000 websites in four months. Each of those was an impression Booble's auction sold, and each carried a fee.

09:41

Arjun Devraj, who runs the company that has never conceded it is an ad company and is now conceding it is an access company, issues a statement in a careful shrug. 'There is no evidence the system was misused, only evidence that it was used,' he says.

Asked whether anyone checked what the vendor did with the access, Devraj says the question is 'adjacent to vetting'.

10:05

A brief explainer. Every time a page loads, dozens or hundreds of companies receive the visitor's device details and location, so they can bid to show an ad. Companies that lose the auction keep what they learned.

The researchers call the attack technique 'zero-click'. In advertising this is also known as the consent model.

10:30

The researchers advise at-risk users to use ad blockers, disable ad tracking and regularly reset their mobile ad ID. Booble says it is 'reviewing which of its products this advice applies to'. A person familiar with the review says the answer is all of them.

The report adds that the ads also reached networks belonging to government agencies, defence bodies and a western military alliance. Researchers found no evidence those networks were infected.

10:48

Dr. Yuki Tanaka, the researcher who brings error bars to rooms that never asked for them, says 'no evidence of infection' is a property of the logs, not of the networks. 'The logs belong to the parties who were paid per impression,' she says. 'I would not build a defence on their curiosity.'

11:15

Booble announces an enhanced approved-vendor programme with a second column on the list, headed 'approved to do what'. Vendors can fill it in themselves, and a paid 'Verified' tier will fill it in faster.

Booble confirms it will not refund fees on the malicious impressions. 'They were delivered,' a spokesperson says. 'That is the product.'

The inevitable…

Within the quarter the vendor will reappear under a new name, an unremarkable 'specialised digital advertising agency' with a game ad and a telecoms ad. It will pass the enhanced review because the review checks whether it bids, and it will bid. Researchers will publish again, Booble will terminate again within hours, and the list will grow by one row.

Check back January 2027