Home | Notifications | New Note | Local | Federated | Search | Logout

Note Detail

Reply to @wchr@mastodon.social
Wolfie Christl@wchr@mastodon.social (2026-10-16 04:04:06)
In addition ad-based spyware from Candiru (now 'Integrity Labs'), we found that Discover-Tech is linked to additional surveillance firms including mercenary spyware vendor Bindecy and ADINT vendor Intelos.

We'll publish a follow-up report on another threat actor we call DARK CARTOGRAPHER that uses Discover tech ads to exploit vulnerabilities across mobile carriers in 30 countries to link device/ad IDs with phone numbers. This actor is linked to additional ADINT firms and a US govt contractor.
---Reply---
Wolfie Christl@wchr@mastodon.social (2026-10-16 04:13:41)
There's a lot of detail in our report, Controlium screenshots, tracking and ID syncing, Discover-Tech's corporate network, the history of its advertising tech, including odd stuff that may justify another investigation.

On a side note, part of what we found relied on Discover-Tech's own hilariously bad security.

A lot of information was publicly accessible without any authentication requirement, including ad bidding logs, source code for admin panels, ad encryption tools and even user logins.
---Attachments---
image: https://files.mastodon.social/media_attachments/files/117/446/504/039/938/942/original/ef972d9427a3105d.png
image: https://files.mastodon.social/media_attachments/files/117/446/503/876/942/167/original/7a42e08e1993c3fc.png

---Replies---

Wolfie Christl@wchr@mastodon.social (2026-10-16 04:36:27)
More broadly, we've seen ad-based malware and we've also seen indications for ad-based spyware delivery, in reports on offensive capabilities offered by ADINT vendors and most profoundly, in Amnesty Security Labs' investigation into Intellexa's ad-based 'Aladdin' infection vector and the co-timed Google report:
https://securitylab.amnesty.org/latest/2025/12/intellexa-leaks-predator-spyware-operations-exposed/
https://cloud.google.com/blog/topics/threat-intelligence/intellexa-zero-day-exploits-continue

To our knowledge, our report presents the first public technical confirmation of a zero-click mercenary spyware attack delivered via ads.