Home | Notifications | New Note | Local | Federated | Search | Logout

Note Detail

Reply to @wchr@mastodon.social
Wolfie Christl@wchr@mastodon.social (2026-10-16 04:13:41)
There's a lot of detail in our report, Controlium screenshots, tracking and ID syncing, Discover-Tech's corporate network, the history of its advertising tech, including odd stuff that may justify another investigation.

On a side note, part of what we found relied on Discover-Tech's own hilariously bad security.

A lot of information was publicly accessible without any authentication requirement, including ad bidding logs, source code for admin panels, ad encryption tools and even user logins.
---Attachments---
image: https://files.mastodon.social/media_attachments/files/117/446/504/039/938/942/original/ef972d9427a3105d.png
image: https://files.mastodon.social/media_attachments/files/117/446/503/876/942/167/original/7a42e08e1993c3fc.png
---Reply---
Wolfie Christl@wchr@mastodon.social (2026-10-16 04:36:27)
More broadly, we've seen ad-based malware and we've also seen indications for ad-based spyware delivery, in reports on offensive capabilities offered by ADINT vendors and most profoundly, in Amnesty Security Labs' investigation into Intellexa's ad-based 'Aladdin' infection vector and the co-timed Google report:
https://securitylab.amnesty.org/latest/2025/12/intellexa-leaks-predator-spyware-operations-exposed/
https://cloud.google.com/blog/topics/threat-intelligence/intellexa-zero-day-exploits-continue

To our knowledge, our report presents the first public technical confirmation of a zero-click mercenary spyware attack delivered via ads.

---Replies---

Wolfie Christl@wchr@mastodon.social (2026-10-16 04:55:05)
Digital advertising is broken. The way it works today is a security threat for states, the private sector, civil society and everyone else alike.

It's difficult, if not almost impossible, to consistently protect yourself from malicious ads. Our findings confirm that ad blocking must be considered a cybersecurity best practice.

What else? Disable the so-called Advertising ID on mobile devices, use opt-out features of apps, use a browser that blocks tracking, if possible block at network level.