Home | Notifications | New Note | Local | Federated | Search | Logout
Note Detail
Reply to @wchr@mastodon.social
Wolfie Christl@wchr@mastodon.social (2026-10-16 00:16:49)
Discover-Tech operated a platform called 'Controlium' that enabled its spyware partners to profile and automatically infect devices when an ad was shown.
To make this work, they 'exploited' the real-time auction system that underpins targeting and data harvesting in today's digital advertising ecosystem. They also 'exploited' the ability to run code attached to ads in apps and browsers.
Discover-Tech operated its own ad buying platform called MyDSP and also used DSPs operated by other firms.
---Attachments---
image: https://files.mastodon.social/media_attachments/files/117/445/582/830/370/377/original/320f074764dfdb64.png
---Reply---
Wolfie Christl@wchr@mastodon.social (2026-10-16 00:21:17)
We found that Discover-Tech delivered ads via Google, Yandex and other ad vendors including Beeswax (Comcast), Vungle (Liftoff), Eskimi and Sunteng.
Discover-Tech was listed as a 'certified' and 'approved' ad vendor by Google and the advertising industry association IAB Europe from 2020 until Oct 2026.
The ad vendor registries maintained by Google and IAB Europe helped make Discover-Tech appear to be a legitimate vendor and facilitated its participation in the advertising ecosystem at scale.
---Attachments---
image: https://files.mastodon.social/media_attachments/files/117/445/598/699/331/493/original/9903297ab017febe.png
Reply
---Replies---
Wolfie Christl@wchr@mastodon.social (2026-10-16 00:28:19)
And this is how Discover-Tech facilitated a zero-click Candiru spyware infection:
1. Target user with a Discover-Tech ad with JavaScript code attached
2. Select user for validation? Connect to Candiru validator server
3. Select user for infection? Connect to Candiru infection server
4. Device infected? Connect to Candiru C&C server
Discover-Tech also received a lot of device and identity data using its impression and click tracking systems, whether a user was selected for infection or not.
---Attachments---
image: https://files.mastodon.social/media_attachments/files/117/445/615/356/727/605/original/cda70197c63b9ac8.png