Wolfie Christl (@wchr.bsky.social)

Wolfie Christl

@wchr.bsky.social

Public-interest researcher at Cracked Labs | Senior Researcher at The Citizen Lab | Vienna, Austria | Tech and society. Tracking, surveillance, consumer data, platform power, algorithmic decisions, datafication of work. wolfie.crackedlabs.org/en

4.9K followers 366 following554 posts

Pinned

Wolfie Christl

@wchr.bsky.social

A company deeply embedded in digital advertising weaponized ads to help infect 45+ devices at the news network Al Jazeera with Candiru spyware. In this new @citizenlab.ca report, we present the first public technical confirmation of a zero-click mercenary spyware attack delivered via targeted ads:

citizenlab.caExposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware - The Citizen LabThis is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Ca...

Wolfie Christl

@wchr.bsky.social

"AI agents are agents of the person or organization that deploys them—and should be treated by the law as such. ... To allow businesses to hide behind the excuse of faulty AI ... would introduce disastrous incentives for corporate misbehavior" www.schneier.com/blog/archive...

schneier.comAI and Liability - Schneier on SecurityEarlier this month, a German court ruled that Google is liable for its AI search summaries. Rejecting defenses like “users can check for themselves,” and that they generally know “that information gen...

Wolfie Christl

@wchr.bsky.social

I'd add that persons and organizations that deploy them should of course be able to hold the providers of AI agent services liable for their promises.

Wolfie Christl

@wchr.bsky.social

22h

FTC to Publicis/LiveRamp: "Feel free to operate your extensive consumer/identity surveillance services as you see fit as long as you offer them to everyone" #datamarkets www.ftc.gov/system/files...

Wolfie Christl reposted

Wolfie Christl

@wchr.bsky.social

Some more background on the role of the digital advertising industry in ad-based spyware delivery. At the core of our new @citizenlab.ca report is Discover-Tech, a company that was deeply interconnected with the ad industry for years yet operated as a facilitator for spyware vendors like Candiru.

Wolfie Christl

@wchr.bsky.social

So $25 billion, this is what I call a fine. Can't look into the details right now, but I think all the statements by FB/Meta and its executives that the court found to be willfully deceptive deserve a lot of attention. www.techpolicy.press/eight-years-... nmdoj.gov/press-releas...

Authorities in several regions must investigate Discover-Tech and the surveillance firms linked to it. Policymakers must fix the systemic risks that enable ad-based spyware delivery. And I think GDPR regulators should investigate the personal data processing practices of the involved ad vendors.

Wolfie Christl

@wchr.bsky.social

Our report: citizenlab.ca/research/how... - Section 9 + Appendix A examine the involved ad vendors - Sections 3, 5, 6 and 7 analyze Discover-Tech's ad targeting and tech - Sections 10+11 discuss our findings and provide recommendations Also read Confiant's report: blog.confiant.com/p/adint-weap...

Company records show: From 2020 to 2025, Discover-Tech Ltd's directors included Eric Banoun, a "pioneer of offensive cyber in Israel" (Haaretz) who previously founded surveillance firms Circles & Senpai. From 2020 to 2026, its shareholders included a firm Haaretz linked to spyware group Intellexa.

Wolfie Christl

@wchr.bsky.social

As a result of the investigation, Discover-Tech has now been widely disconnected from the ads ecosystem. I'm however pretty sure this isn't the last 'bad apple' in the ecosystem. Some say, digital advertising is compromised. I'd rather say, it works as intended, and it's a systemic security threat.

Fourth, and most consequential: Discover-Tech was 'approved' and 'certified' to be listed in ad vendor registries maintained by Google and the major industry association IAB Europe from 2020 until Oct 2026. These listings facilitated the company's participation in the online ads ecosystem at scale.

Wolfie Christl

@wchr.bsky.social

Major ad vendors and organizations failed to detect the company's malicious ad operations for years. Beyond detecting malicious ads or uncommon ad-buying patterns, easily accessible public information could have told them that the 'advertising' firm Discover-Tech was linked to the spyware industry.

Data published by @jurrevanbergen.nl indicates that MyDSP also delivered ads via Unity Ads. At some unspecified point in time, MyDSP might have been connected to additional ad vendors Inneractive, MobFox, MoPub, PulsePoint, RhythmOne, GumGum, PubMatic, Smaato, Sonobi, NativeAds, Q1Media, Applovin.

Wolfie Christl@wchr.bsky.social

Btw. as we briefly discuss in our report, publicly viewable code suggests that Discover-Tech's MyDSP system might have been connected to additional ad vendors at some point, including Inneractive, MobFox, MoPub, PulsePoint, RhythmOne, GumGum, PubMatic, Smaato, Sonobi, NativeAds, Q1Media, Applovin.

Wolfie Christl

@wchr.bsky.social

Second, beyond MyDSP, Discover-Tech purchased additional ad buying services from Comcast's ad system Beeswax and the smaller Lithuanian vendor Eskimi. Third, Discover-Tech tracked website users also without showing them ads and synchronized user IDs with Yandex, Beeswax and Microsoft Advertising.

We found that Discover-Tech used RTB real-time auctions to target millions of users across 200k websites and apps in many countries to show them ads carrying JS code that exposed them at least to profiling, if not worse. In 2024 and 2025, some of those ads initiated infections with Candiru spyware.

Wolfie Christl

@wchr.bsky.social

So why was Discover-Tech able to deliver billions of ads for years? Because it was connected to several other ad vendors. First, it operated its own ad buying system MyDSP, which delivered ads via Google, Yandex, the US ad vendor Liftoff and the Chinese vendor Sunteng, according to ad bidding data.

Wolfie Christl reposted

Hannah Neumann

@hneumannmep.bsky.social

Together with @saskiabricmont.bsky.social and 33 other MEPs from 5 political groups, we urge @europarl.europa.eu, @ec.europa.eu and @consilium.europa.eu to investigate their exposure to zero-click spyware. More in our letter: 1/2

Wolfie Christl

@wchr.bsky.social

As @donncha.is & @jurrevanbergen.nl wrote on former Twitter, Amnesty Security Lab was also tracking the ad-based spyware facilitator Discover-Tech. Jurre now published an analysis of ad bidding data 2025-26 and a world-readable s3 bucket: www.threatnotify.org/projects/dt/ github.com/Threatnotify...

View full thread

Wolfie Christl

@wchr.bsky.social

The world-readable s3 bucket contained mostly images/creatives for Discover-Tech ad campaigns, but also a few other files like a sellers.json file, a screenshot of a report on ad campaigns for YellowTie games and a Saudi fashion retailer, and folder names like 'GuyTest' and 'Dekel_NEW_creatives'.

Also very interesting: - Analysis of ad-targeted networks including government bodies, defense and security organizations - The ad campaign names often refer to specific country targets: RUS, BLR, ARM, AZE, UA, CN, PAK, IDN, THA, MYS, SGP, YEM, ISR, UAE, AUS, MNE, LVA, HUN, CZE, DNK, NOR, ITA, ESP

Wolfie Christl

@wchr.bsky.social

We believe the druid instances contained ad bidding data for Discover-Tech's MyDSP platform, which was connected to the ad vendors Google, Yandex, Vungle/Liftoff, Sunteng, and as shown above, Unity Ads, but those instances did not contain any data about Discover-Tech's use of Beeswax or Eskimi DSPs.

While we analyzed only 4 months of ad bidding data from the world-readable druid instance, the samples from Jan 2025 to Aug 2026 indicate that Discover-Tech also delivered ads via Unity Ads, the ad system operated by game engine vendor Unity, in addition to the ad vendors we examine in our report.

Wolfie Christl reposted

John Wilander

@wilander.bsky.social

Read about the latest update to Safari's anti tracking: Blocking Identity Resolution Infrastructure. We will continue to prevent covert and cross-site tracking by default, while maintaining the ability for websites to provide first-party personalization to their users. webkit.org/blog/18438/b...

webkit.orgBlocking Identity Resolution InfrastructureApple and WebKit have shipped protections against web tracking for a long time.

Wolfie Christl reposted

Zach Edwards

@thezedwards.bsky.social

Our team at @decryptads.bsky.social is out today with our first report, which we’ve been working on for months. The research is focused on AI slop recipe and cooking websites, the fake chefs who supposedly run them, and the Russian and Chinese ad tech companies integrated into the sites..🧵

Wolfie Christl

@wchr.bsky.social

"Beim nationalen Computer Emergency Response Team (CERT) sieht man ... im Onlinewerbemarkt generell dringenden Regulierungsbedarf. Die Weitergabe von Daten sei mittlerweile außer Kontrolle geraten, sagte Experte Otmar Lendl. Der Markt sei 'ein regelrechtes Minenfeld für Datenschutzverletzungen'."

orf.at„AdFection“: Onlinewerbung als Einfallstor für SpionageForschende des Citizen Lab von der Universität Toronto haben dokumentiert, wie manipulierte Onlinewerbung dazu genutzt werden kann, Endgeräte wie Computer und Handys unbemerkt mit Spionagesoftware zu ...

Wolfie Christl

@wchr.bsky.social

The Citizen Lab's director @rondeibert.bsky.social spoke to CBC about what happens when "two poorly regulated and highly abused industries", targeted advertising and mercenary spyware, come together: www.cbc.ca/news/world/i...

cbc.ca'Recipe for disaster': Israeli firm used ads to enable espionage, report says | CBC NewsAn Israeli advertising agency has placed ads seen by millions of internet users that have left them open to spyware attacks, according to a new report from the University of Toronto's Citizen Lab.

Wolfie Christl reposted

Zack Whittaker

@zackwhittaker.com

By far the most detailed, investigative cybersecurity report of the year, probably. Breathtakingly incredible research here.

Wolfie Christl@wchr.bsky.social

In addition to Candiru (Integrity Labs) we found that Discover-Tech is linked to spyware firm Bindecy and ADINT firm Intelos. We'll publish a follow-up report on another threat actor we call DARK CARTOGRAPHER that uses Discover-Tech ads and telco vulnerabilities (!) to link ad IDs to phone numbers.

Wolfie Christl

@wchr.bsky.social

The way online advertising works today is a security threat for states, the private sector, civil society and everyone else alike. Cybersecurity agencies, regulators and lawmakers in the US, Europe and elsewhere must investigate ad-based spyware delivery and fix the systemic risks that enable it.

Wolfie Christl reposted

Matt Burgess (WIRED)

@mattburgess1.bsky.social

NEW: Yeah, not good

wired.com‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted AdsResearchers at The Citizen Lab have for the first time released technical evidence of sophisticated mercenary spyware being distributed via online advertising.

Wolfie Christl reposted

Ron Deibert

@rondeibert.bsky.social

NEW @citizenlab.ca report We uncovered an Israeli firm using online ads to run vast spy operation This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. 45 devices at @aljazeera.com confirmed infected citizenlab.ca/research/how...

In addition to actual infections, we found 4 billion ad bidding records from Discover-Tech's MyDSP system. From March to June 2026, hundreds of millions of their ads were shown to users of almost 200k different websites and apps. Millions of people were at least subject to profiling, if not worse.

Wolfie Christl

@wchr.bsky.social

The bidding records also show that Discover-Tech ads were shown to users within IP networks of NATO, UN, EU institutions and a wide range of organizations in many countries including in defense, government, critical infrastructure, industry and media. …exposing them to potential spyware targeting.

We found that Discover-Tech delivered ads via Google, Yandex and other ad vendors including Beeswax (Comcast), Vungle (Liftoff), Eskimi and Sunteng. Also, it was listed as a 'certified' and 'approved' ad vendor by Google and the advertising industry association IAB Europe from 2020 until Oct 2026.

Wolfie Christl

@wchr.bsky.social

And this is how Discover-Tech facilitated a Candiru spyware infection: 1. Target user with an ad, JavaScript code attached 2. Select user for targeting? Connect to Candiru validator server 3. Select for infection? Connect to Candiru infection server 4. Device infected? Connect to Candiru C&C server

At the core of our report is Discover-Tech, which presented itself as a 'legitimate' adtech firm but which we found operated as a bridge between surveillance vendors and the digital advertising industry. As a result of the investigation, it has now been widely disconnected from the ads ecosystem.

Wolfie Christl

@wchr.bsky.social

Discover-Tech operated a platform called 'Controlium' that enabled its spyware partners to profile and automatically infect devices when an ad was shown. To make this work, they exploited the real-time auction system in today's digital advertising, plus the ability to run code in apps and browsers.

My colleagues at the University of Toronto's @citizenlab.ca and I spent more than a year on it. Ad security firm Confiant published a parallel report: blog.confiant.com/p/adint-weap... And check out the excellent media reports on our research including Reuters, NBC News, FT, Wired, Forbes & more.

blog.confiant.comADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity VacuumingConfiant Threat Intelligence - security@confiant.com

Wolfie Christl

@wchr.bsky.social

Today the Norwegian GDPR regulator announced a fine against the surveillance advertising company Xandr for unlawfully transmitting data on Norwegian Grindr users to "potentially thousands of companies", based on an investigation I spent a lot of time on in 2019: www.forbrukerradet.no/side/microso...

forbrukerradet.noMicrosoft company fined 8,5 million euros following complaint by the Norwegian Consumer Council and noybThe Norwegian Data Protection Authority has fined the Microsoft subsidiary Xandr 8,5 million euros million (NOK 92 million) after the Norwegian Consumer Council uncovered that the dating app Grindr pr...

Wolfie Christl

@wchr.bsky.social

Very good: a clear decision about what's unlawful with ramifications for the broader adtech industry and RTB at large Less than ideal: 6 years until enforcement; low fine because the fine is about Norwegian users only + aligned with the turnover of Xandr, not its parent: formerly AT&T now Microsoft

Wolfie Christl reposted

Finn Lützow-Holm Myrstad

@finnmyrstad.bsky.social

🎉 Great news! Microsoft is fined €8,5 million by the Norwegian Data Protection Authority for sharing personal data to potentially thousands of companies! www.forbrukerradet.no/side/microso... 1/

Wolfie Christl reposted

Wolfie Christl

@wchr.bsky.social

Staatliche Behörden kaufen Standort- und Verhaltensdaten aus der Online-Werbung für Überwachung - in den USA, El Salvador, Ungarn und auch in Österreich. Wie funktioniert das? Warum ist das (grund)rechtlich ein einziges Desaster? Mein Vortrag auf der re:publica Wien: www.youtube.com/watch?v=cahD...

youtube.comWolfie Christl: Illegale Massenüberwachung mit App- und Werbedaten – re:publica Vienna 2026YouTube video by re:publica Vienna

Wolfie Christl

@wchr.bsky.social

youtube.comWolfie Christl: Illegale Massenüberwachung mit App- und Werbedaten – re:publica Vienna 2026YouTube video by re:publica Vienna

Wolfie Christl

@wchr.bsky.social

Youtube wird neu hochgeladen, wie ich höre. Anyway, eh viel besser, das Video gibts ganz ohne YT/Tracking auch hier: tube.moment.at/w/38HawnMtwB...

tube.moment.atWolfie Christl: Illegale Massenüberwachung mit App- und Werbedaten – re:publica Vienna 2026Eine Untersuchung des Wall Street Journal hat 2020 erstmals aufgedeckt, dass staatliche Behörden - wie die US-Abschiebebehörde ICE - Daten aus der Online-Werbung und von Smartphone-Apps für Überwac...

Wolfie Christl

@wchr.bsky.social

Noteworthy. In recent years, this adtech/data group named Infillion acquired the ruins of adint supplier UberMedia, assets from DrawBridge, MediaMath, retail data broker Catalina and location data brokers Fysical, Gimbal, Foursquare, including Placed, Factual. www.adexchanger.com/marketers/in...

adexchanger.comInfillion Acquires Foursquare, Adding More Location Data To Its Ever-Growing Ad Tech Stack | AdExchangerInfillion checked in with its latest acquisition on Friday: Foursquare. Terms of the deal were nor disclosed.

Wolfie Christl reposted

Roland Meyer

@bildoperationen.bsky.social

Social media is a paranoia machine. It makes connections explicit, though not transparent. It not only allows you to trace ties between people, institutions, and events, but also continually produces new ties. On social media, everything becomes connected, and thus potentially suspicious

Wolfie Christl reposted

Sebastian Meineck

@sebmeineck.bsky.social

Kirchen, Moscheen, Synagogen: Datenhändler gefährden Gläubige in Deutschland. Dahinter stecken frei verkäufliche Handy-Standortdaten. @roofjoke.netzpolitik.org & ich haben mehr als eine Million Standortdaten an Glaubensorten gefunden. #DatabrokerFiles netzpolitik.org/2026/kirchen... 1/3

netzpolitik.orgDatenhändler gefährden Gläubige in DeutschlandReligiöse Menschen lassen sich mit frei verkäuflichen Handy-Standortdaten der Werbe-Industrie ausspionieren. Mehr als eine Million Standortdaten an Glaubensorten fand netzpolitik.org in kostenlosen Vo...