Wolfie Christl@wchr@mastodon.social: In addition to actual infections, we found 4 billi…

Home | Notifications | New Note | Local | Federated | Search | Logout

Note Detail

Reply to @wchr@mastodon.social
Wolfie Christl@wchr@mastodon.social (2026-10-16 00:28:19)
And this is how Discover-Tech facilitated a zero-click Candiru spyware infection:

1. Target user with a Discover-Tech ad with JavaScript code attached
2. Select user for validation? Connect to Candiru validator server
3. Select user for infection? Connect to Candiru infection server
4. Device infected? Connect to Candiru C&C server

Discover-Tech also received a lot of device and identity data using its impression and click tracking systems, whether a user was selected for infection or not.
---Attachments---
image: https://files.mastodon.social/media_attachments/files/117/445/615/356/727/605/original/cda70197c63b9ac8.png
---Reply---
Wolfie Christl@wchr@mastodon.social (2026-10-16 00:34:42)
In addition to actual infections, we found 4 billion ad bidding records from Discover-Tech's MyDSP system.

From March to June 2026, hundreds of millions of their ads were shown to users of almost 200k different websites and apps.

Millions of people were at least subject to profiling, if not worse.

This includes users within IP networks of NATO, UN, EU institutions and a wide range of organizations in many countries including in defense, government, critical infrastructure, industry and media.
---Attachments---
image: https://files.mastodon.social/media_attachments/files/117/445/652/914/240/283/original/f5effc74471d1366.png


---Replies---

Wolfie Christl@wchr@mastodon.social (2026-10-16 04:04:06)
In addition ad-based spyware from Candiru (now 'Integrity Labs'), we found that Discover-Tech is linked to additional surveillance firms including mercenary spyware vendor Bindecy and ADINT vendor Intelos.

We'll publish a follow-up report on another threat actor we call DARK CARTOGRAPHER that uses Discover tech ads to exploit vulnerabilities across mobile carriers in 30 countries to link device/ad IDs with phone numbers. This actor is linked to additional ADINT firms and a US govt contractor.