Ads Weaponized for
Surveillance
What we learned uncovering a covert surveillance operation, and the questions the advertising industry now needs to answer.
Keep Me Informed
It all started in April when we found an unusual ad. We thought: if someone wanted to deliver a zero-day browser exploit to a device, this is how they'd do it. After we began blocking for our clients, we set out to figure out what it was doing, who was controlling it, and how we could help the industry do something about it.
Four months later, having enough evidence to negate plausible deniability, we led the takedown that disrupted the ad ecosystem access of Discover-Tech Ltd. Discover-Tech was the bridge— the profiteer doing what the ad industry had feared for years: abusing ad tech targeting capabilities for surveillance purposes at scale.
Along the way, through our own research and work with research partners, including Citizen Lab, we identified how this entity abused its position to sell advertising-based tracking ("ADINT") to cyber surveillance and spyware actors, including Candiru. We learned a lot about how they operate, how they connect to the cyber surveillance industry, how they target spyware victims, and the massive scale of their footprint since they started in 2020.
With this clear evidence that ads were being used as surveillance infrastructure, we shared our briefing in a coordinated disclosure such that major players in the ad industry came together to cut off Discover-Tech’s access and protect the industry’s capabilities from being further abused.
READ THE TECHNICAL DEEP DIVE
ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming ↗
The hardest work remains. Disrupting Discover-Tech’s access was an important step. But it does not mean the actors behind these operations will stop, or that the conditions they exploited have been resolved.
There are lots of uncomfortable questions that need to be answered so the ad industry can figure out the learnings and the right next steps.
Top of mind, from Confiant’s point of view, those include:
-
• How are responsibility and accountability distributed across the ecosystem?
-
• How do we get to better business protocols and stronger technical standards?
-
• How do we achieve buyer transparency and faster threat identification?
We believe what happens next matters deeply for the open web and the businesses that depend on it.
Join us to work through what publishers and platforms can change within their own businesses and across the industry.
Louis-David Mangin & Jerome Dangu
Co-founders, Confiant
This is not business as usual.
- Can you investigate what an ad does on your site or app after it renders?
- Can your demand partners help identify the buyer behind suspicious activity?
- Do you understand who your buyers are and the purpose of their campaigns?
- Do you have processes in place to vet advertising partners to approve access to JavaScript execution, cookie syncing, and other high-risk features and data streams?
- Can you investigate behavior beyond initial approval?
- Do you require demand chain visibility from your upstream partners?
- What privacy-preserving measures could discourage surveillance actors from abusing ad tech?
Let's work through these questions together.
Get updates on our upcoming discussions.
What happens next?
Join publishers and platforms working through what needs to change in their businesses and across the industry. We’ll share what we’re learning, practical tools, and opportunities to work together.
First up
A live discussion with the Confiant team on the findings, the business implications and where we can act. Dates to be announced.
