Home | Notifications | New Note | Local | Federated | Search | Logout
Wolfie Christl@wchr@mastodon.social
Public-interest researcher https://crackedlabs.org | Senior researcher at http://citizenlab.ca/ | Tech and society. Tracking, surveillance, consumer data, platform power, algorithmic decisions, datafication of work.
https://wolfie.crackedlabs.org/en
Joined: 2026-10-17 21:38:39
11 notes, 0 following, 0 followers
Reply to @wchr@mastodon.social
Wolfie Christl@wchr@mastodon.social (2026-10-16 04:55:05)
Digital advertising is broken. The way it works today is a security threat for states, the private sector, civil society and everyone else alike.
It's difficult, if not almost impossible, to consistently protect yourself from malicious ads. Our findings confirm that ad blocking must be considered a cybersecurity best practice.
What else? Disable the so-called Advertising ID on mobile devices, use opt-out features of apps, use a browser that blocks tracking, if possible block at network level.
Reply to @wchr@mastodon.social
Wolfie Christl@wchr@mastodon.social (2026-10-16 04:36:27)
More broadly, we've seen ad-based malware and we've also seen indications for ad-based spyware delivery, in reports on offensive capabilities offered by ADINT vendors and most profoundly, in Amnesty Security Labs' investigation into Intellexa's ad-based 'Aladdin' infection vector and the co-timed Google report:
https://securitylab.amnesty.org/latest/2025/12/intellexa-leaks-predator-spyware-operations-exposed/
https://cloud.google.com/blog/topics/threat-intelligence/intellexa-zero-day-exploits-continue
To our knowledge, our report presents the first public technical confirmation of a zero-click mercenary spyware attack delivered via ads.
Reply to @wchr@mastodon.social
Wolfie Christl@wchr@mastodon.social (2026-10-16 04:13:41)
There's a lot of detail in our report, Controlium screenshots, tracking and ID syncing, Discover-Tech's corporate network, the history of its advertising tech, including odd stuff that may justify another investigation.
On a side note, part of what we found relied on Discover-Tech's own hilariously bad security.
A lot of information was publicly accessible without any authentication requirement, including ad bidding logs, source code for admin panels, ad encryption tools and even user logins.
---Attachments---
image: https://files.mastodon.social/media_attachments/files/117/446/504/039/938/942/original/ef972d9427a3105d.png
image: https://files.mastodon.social/media_attachments/files/117/446/503/876/942/167/original/7a42e08e1993c3fc.png
Reply to @wchr@mastodon.social
Wolfie Christl@wchr@mastodon.social (2026-10-16 04:04:06)
In addition ad-based spyware from Candiru (now 'Integrity Labs'), we found that Discover-Tech is linked to additional surveillance firms including mercenary spyware vendor Bindecy and ADINT vendor Intelos.
We'll publish a follow-up report on another threat actor we call DARK CARTOGRAPHER that uses Discover tech ads to exploit vulnerabilities across mobile carriers in 30 countries to link device/ad IDs with phone numbers. This actor is linked to additional ADINT firms and a US govt contractor.
Reply to @wchr@mastodon.social
Wolfie Christl@wchr@mastodon.social (2026-10-16 00:34:42)
In addition to actual infections, we found 4 billion ad bidding records from Discover-Tech's MyDSP system.
From March to June 2026, hundreds of millions of their ads were shown to users of almost 200k different websites and apps.
Millions of people were at least subject to profiling, if not worse.
This includes users within IP networks of NATO, UN, EU institutions and a wide range of organizations in many countries including in defense, government, critical infrastructure, industry and media.
---Attachments---
image: https://files.mastodon.social/media_attachments/files/117/445/652/914/240/283/original/f5effc74471d1366.png
Reply to @wchr@mastodon.social
Wolfie Christl@wchr@mastodon.social (2026-10-16 00:28:19)
And this is how Discover-Tech facilitated a zero-click Candiru spyware infection:
1. Target user with a Discover-Tech ad with JavaScript code attached
2. Select user for validation? Connect to Candiru validator server
3. Select user for infection? Connect to Candiru infection server
4. Device infected? Connect to Candiru C&C server
Discover-Tech also received a lot of device and identity data using its impression and click tracking systems, whether a user was selected for infection or not.
---Attachments---
image: https://files.mastodon.social/media_attachments/files/117/445/615/356/727/605/original/cda70197c63b9ac8.png
Reply to @wchr@mastodon.social
Wolfie Christl@wchr@mastodon.social (2026-10-16 00:21:17)
We found that Discover-Tech delivered ads via Google, Yandex and other ad vendors including Beeswax (Comcast), Vungle (Liftoff), Eskimi and Sunteng.
Discover-Tech was listed as a 'certified' and 'approved' ad vendor by Google and the advertising industry association IAB Europe from 2020 until Oct 2026.
The ad vendor registries maintained by Google and IAB Europe helped make Discover-Tech appear to be a legitimate vendor and facilitated its participation in the advertising ecosystem at scale.
---Attachments---
image: https://files.mastodon.social/media_attachments/files/117/445/598/699/331/493/original/9903297ab017febe.png
Reply to @wchr@mastodon.social
Wolfie Christl@wchr@mastodon.social (2026-10-16 00:16:49)
Discover-Tech operated a platform called 'Controlium' that enabled its spyware partners to profile and automatically infect devices when an ad was shown.
To make this work, they 'exploited' the real-time auction system that underpins targeting and data harvesting in today's digital advertising ecosystem. They also 'exploited' the ability to run code attached to ads in apps and browsers.
Discover-Tech operated its own ad buying platform called MyDSP and also used DSPs operated by other firms.
---Attachments---
image: https://files.mastodon.social/media_attachments/files/117/445/582/830/370/377/original/320f074764dfdb64.png
Reply to @wchr@mastodon.social
Wolfie Christl@wchr@mastodon.social (2026-10-16 00:09:44)
At the core of our report is the Israeli firm Discover-Tech Ltd, which presents itself as a 'legitimate' advertising firm but which we found operated as a bridge between surveillance vendors and the digital advertising industry.
As a result of the investigation, Discover-Tech has now been widely disconnected from the ads ecosystem.
---Attachments---
image: https://files.mastodon.social/media_attachments/files/117/445/553/843/587/473/original/c416dbe8ffcdbe89.png
Reply to @wchr@mastodon.social
Wolfie Christl@wchr@mastodon.social (2026-10-15 21:39:15)
My colleagues at the University of Toronto's @citizenlab and I spent more than a year on this.
Ad security firm Confiant published a parallel report:
https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming
And check out the excellent media reports on our research:
https://www.reuters.com/legal/litigation/israeli-firm-used-online-ads-run-vast-spy-operation-researchers-say-2026-10-15/
https://www.nbcnews.com/tech/security/israeli-ad-company-helped-spyware-firm-target-al-jazeera-online-ads-re-rcna602999
https://www.ft.com/content/b857f1ed-8af6-4d64-b059-912afee1c075
https://www.theguardian.com/technology/2026/oct/15/israeli-firm-digital-ads-enabling-installation-of-zero-click-spyware-researchers-say
https://www.forbes.com/sites/thomasbrewster/2026/10/15/israeli-spyware-ads-target-journalists/
https://www.bloomberg.com/news/articles/2026-10-15/israeli-firms-placed-spyware-at-al-jazeera-via-ads-report-says
https://www.wired.com/story/nightmare-scenario-zero-click-spyware-is-infecting-phones-via-targeted-ads/
https://techcrunch.com/2026/10/15/citizen-lab-says-governments-are-abusing-online-ads-to-hack-people-with-zero-click-spyware/
https://www.tagesschau.de/investigativ/br-recherche/spionage-software-werbung-100.html
https://netzpolitik.org/2026/angriff-auf-al-jazeera-der-trojaner-kam-per-online-werbung/
https://www.fanpage.it/attualita/banner-di-finte-pubblicita-cosi-unazienda-israeliana-ha-esposto-camera-e-difesa-ad-attacchi-spyware/
---Attachments---
image: https://files.mastodon.social/media_attachments/files/117/444/964/194/649/649/original/ccc75a3cf7e2ec32.png
Wolfie Christl@wchr@mastodon.social (2026-10-15 21:30:17)
Discover-Tech, a company deeply embedded in the digital advertising ecosystem, weaponized ads to profile millions of people in many countries and to help infect 45+ devices within the news network Al Jazeera with Candiru spyware.
In this new @citizenlab report, we document the first public technical confirmation of a zero-click mercenary spyware attack delivered via targeted ads:
https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/