Home | Notifications | New Note | Local | Federated | Search | Logout

Note Detail

Reply to @wchr@mastodon.social
Wolfie Christl@wchr@mastodon.social (2026-10-15 21:39:15)
My colleagues at the University of Toronto's @citizenlab and I spent more than a year on this.

Ad security firm Confiant published a parallel report:
https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming

And check out the excellent media reports on our research:
https://www.reuters.com/legal/litigation/israeli-firm-used-online-ads-run-vast-spy-operation-researchers-say-2026-10-15/
https://www.nbcnews.com/tech/security/israeli-ad-company-helped-spyware-firm-target-al-jazeera-online-ads-re-rcna602999
https://www.ft.com/content/b857f1ed-8af6-4d64-b059-912afee1c075
https://www.theguardian.com/technology/2026/oct/15/israeli-firm-digital-ads-enabling-installation-of-zero-click-spyware-researchers-say
https://www.forbes.com/sites/thomasbrewster/2026/10/15/israeli-spyware-ads-target-journalists/
https://www.bloomberg.com/news/articles/2026-10-15/israeli-firms-placed-spyware-at-al-jazeera-via-ads-report-says
https://www.wired.com/story/nightmare-scenario-zero-click-spyware-is-infecting-phones-via-targeted-ads/
https://techcrunch.com/2026/10/15/citizen-lab-says-governments-are-abusing-online-ads-to-hack-people-with-zero-click-spyware/
https://www.tagesschau.de/investigativ/br-recherche/spionage-software-werbung-100.html
https://netzpolitik.org/2026/angriff-auf-al-jazeera-der-trojaner-kam-per-online-werbung/
https://www.fanpage.it/attualita/banner-di-finte-pubblicita-cosi-unazienda-israeliana-ha-esposto-camera-e-difesa-ad-attacchi-spyware/
---Attachments---
image: https://files.mastodon.social/media_attachments/files/117/444/964/194/649/649/original/ccc75a3cf7e2ec32.png
---Reply---
Wolfie Christl@wchr@mastodon.social (2026-10-16 00:09:44)
At the core of our report is the Israeli firm Discover-Tech Ltd, which presents itself as a 'legitimate' advertising firm but which we found operated as a bridge between surveillance vendors and the digital advertising industry.

As a result of the investigation, Discover-Tech has now been widely disconnected from the ads ecosystem.
---Attachments---
image: https://files.mastodon.social/media_attachments/files/117/445/553/843/587/473/original/c416dbe8ffcdbe89.png

---Replies---

Wolfie Christl@wchr@mastodon.social (2026-10-16 00:16:49)
Discover-Tech operated a platform called 'Controlium' that enabled its spyware partners to profile and automatically infect devices when an ad was shown.

To make this work, they 'exploited' the real-time auction system that underpins targeting and data harvesting in today's digital advertising ecosystem. They also 'exploited' the ability to run code attached to ads in apps and browsers.

Discover-Tech operated its own ad buying platform called MyDSP and also used DSPs operated by other firms.
---Attachments---
image: https://files.mastodon.social/media_attachments/files/117/445/582/830/370/377/original/320f074764dfdb64.png