GhostWire Secure

Citizen Lab researchers have documented a new malware campaign called AdFection that distributed spyware to journalists through an advertising network. The target didn't need to click anything. The ad loaded and the infection happened. Zero interaction required.

Ad networks are delivery infrastructure. When an ad is served to your browser or app, code runs on your device before you see it. AdFection used that window. Every device connected to the infected ad network was a potential target, regardless of what they clicked.

ICE is spending $100 million to map the contact graph of US activists. OPM handed the same type of record to DOGE in January. Candiru spyware extracts it from journalist devices. DHS wanted it from Samuel Tunick's wiped phone. One product. Many names.

PRISM called it metadata. Palantir built an industry around it. ERO-ONE budgeted $100 million to do it to activists. Three industry sectors. One dataset.

ICE is spending $100 million to map the contact graph of US activists. OPM handed the same type of record to DOGE in January. Candiru spyware extracts it from journalist devices. DHS wanted it from Samuel Tunick's wiped phone. One product. Many names.

The contact graph is the surveillance target. Not what you said. The fact that you spoke to this person, on this date, and how often. That's how you identify a network. That's how you dismantle it.

www.youtube.com/watch?v=WOOw...

www.youtube.com/watch?v=SOQy...

www.youtube.com/watch?v=WOOw...

A New Mexico judge has ordered Meta to pay $25 billion after a jury found the company misled consumers in the Cambridge Analytica case. Meta collected user data that Trump's 2016 campaign accessed without consent through Cambridge Analytica to build political profiles.

$25 billion is the largest single data privacy verdict in US history. The jury found Meta knew users hadn't consented to their data being used for political targeting. They collected it anyway.

Germany's Berlin Data Protection Authority has ruled that major political parties illegally built voter profiles and microtargeted people during the 2021 federal election. noyb filed the complaints in 2021. Three years later, the authority found it unlawful.

Microtargeting works by building a profile of your political opinions from your browsing and social media history, then showing you content designed to move your vote. The German parties bought that data. The DPA found they had no legal basis to use it.

Azerbaijan's prosecutors are asking for up to 12 years in prison for two journalists and a staff member at Meclis.info, an outlet that covers the country's parliament. The charge isn't espionage. It's financial crime: accepting funding from international donors.

Three people who reported on what their own government did in parliament could spend over a decade in prison for how their newsroom was funded. The journalism isn't in the charge sheet.

Turkish reporter İsmail Arı has been arrested again under the country's disinformation law, on October 22. This year, at least 22 journalists in Turkey have been arrested under the same law. Arı's is a second arrest: he was charged under the same statute before and released.

Turkey's disinformation law doesn't define what disinformation is. There's no standard for falseness, no threshold for actual harm. The vagueness isn't a flaw. It means prosecutors can file it against anything they don't like.

The US Park Police have signed a $343,000 contract to lease mobile surveillance cameras for Washington DC. Federal contract records show the cameras are positioned near the site of Trump's proposed arch, Arlington Memorial Bridge, and the National Mall reflecting pool.

The company supplying the cameras also supplies ICE. Mobile surveillance units aren't fixed infrastructure. They move to wherever the demonstrations are.

Three enforcement actions landed in October 2026. A German regulator found political parties illegally profiled voters. A US jury hit Meta with $25 billion for Cambridge Analytica. Norway's DPA fined Microsoft over Grindr data. Nobody connected them. They're the same case.

The Berlin DPA went after German political parties. The New Mexico court went after Meta. The Norwegian DPA named Xandr. Three separate proceedings, three separate defendants. Nobody looked at the pipes connecting them.

Three enforcement actions landed in October 2026. A German regulator found political parties illegally profiled voters. A US jury hit Meta with $25 billion for Cambridge Analytica. Norway's DPA fined Microsoft over Grindr data. Nobody connected them. They're the same case.

The ad-tech infrastructure that logs your browsing and app use has no single name. Advertisers call it targeting. Cambridge Analytica called it data science. German political parties bought it during a federal election. It's one system.

Six journalists from Matsadaash, an independent investigative platform in Egypt, were arrested on September 28 and 29, 2026. They were held for five to six days in undisclosed locations. Their families had no idea where they were. Their lawyers couldn't reach them.

When they appeared before Egypt's Supreme State Security Prosecution on October 4, they told prosecutors they had been blindfolded, beaten, stripped, given electric shocks, and forced to record false confessions on camera.

Citizen Lab confirmed in October 2026 that at least 45 Al Jazeera journalists were infected with Candiru spyware through ordinary online ads. No click required. The ad loaded in the background and the device was compromised before anyone saw anything.

Candiru spyware extracts files, screenshots, keystrokes, and messages from every major platform on the device. The attack surface is the entire ad ecosystem. Any app or website running programmatic ads is a potential delivery vehicle.

Citizen Lab confirmed in October 2026 that at least 45 Al Jazeera journalists were infected with Candiru spyware through ordinary online ads. No click required. The ad loaded in the background and the device was compromised before anyone saw anything.

ICE is building a $100 million domestic intelligence unit called ERO-ONE. The ACLU published the details on October 19. Its stated purpose: identify threats and investigate relationships between activists and nonprofits.

Hold onto the word 'relationships.' Not communications. Not crimes. The contact graph between an activist and the organisations around them. Who knows who. How often. ERO-ONE is designed to map that.

A federal court ruled on October 20 that OPM violated federal law when it handed millions of federal employee records to DOGE agents. Summary judgment. OPM handed them addresses, security clearances, and medical records of everyone who has ever worked for the US government.

The ruling came after DOGE agents showed up at federal agencies in January 2026, sat down at computers, and walked out with database access no private citizen has any legal right to hold. The court agreed. What it can't do is recover any data already copied and transmitted.

Samuel Tunick is a Stop Cop City activist. At an airport in January 2025, CBP told him they wanted to search his phone for child sexual abuse material. He entered a duress password. The phone wiped. He now faces up to five years in prison for wiping it.

Court records submitted in October 2026 show what DHS actually wrote in the alert: suspected terrorist activities tied to his protest work. The child exploitation claim had no factual basis. A CBP officer confirmed this under oath.