--[ Anomalía #19 - The Advertising Monster ]--

Hello hello!

When capitalism fully embraced the internet, it did so largely through advertising. The formula for turning the internet into a profitable business ultimately relied on a new advertising logic: understanding each person as thoroughly as possible in order to show them the ad most likely to convince them to buy something.

And it worked. So well that it turned information about our lives into one of the most valuable resources on the internet.

Since then, the incentive to learn more about those of us who use online services has only grown. Every visit, search, interaction, or movement can leave a trace that, combined with many others, allows for the construction of incredibly detailed profiles of individuals.

From a marketing perspective, this is pure gold. From a privacy and human rights perspective, it’s a nightmare.

Corporations whose primary incentive is profit have built an infrastructure capable of deciding, with terrifying precision, what advertising each person receives. And to do so, they have developed mechanisms for collecting, sharing, and analyzing information that now have far more worrisome applications than selling us shoes.

In this edition of Anomalía, we review a Citizen Lab investigation, Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware, which shows how far this ecosystem can go: the internet’s advertising infrastructure can be used to deliver sophisticated spyware to specifically selected people, without them needing to click on a malicious link.

The idea didn’t appear out of thin air. In December 2025, Amnesty Tech published To Catch a Predator, an investigation based on leaked Intellexa internal documents. There, we learned about Aladdin, a component the company promoted as capable of converting one-click exploit chains into zero-click attacks using targeted advertising.

But how can advertising end up becoming a surveillance tool or even a mechanism to compromise a device?

The answer lies, in large part, in the way advertising works on the Internet.

Every time we load a page or app that displays ads, a tiny automated auction can take place, lasting only milliseconds. An advertising platform shares information about the person and their device with potential ad buyers, who calculate how much they are willing to pay to display the ad.

This information may include device characteristics, approximate location, interests, and identifiers that allow a person to be recognized across various services. Buyers can cross-reference this information with their own databases to decide whether it’s worth participating in the auction.

All of this happens before we finish loading the page.

And here one of the most problematic aspects of the system appears: to receive information about a person it is not always necessary to win the auction or show them advertising.

For years, companies that collect and sell information, known as data brokers, have leveraged various advertising data sources to build massive databases of information about people and devices. Some of this information ends up being used for tracking, geolocation, and other surveillance services.

Advertising identifiers are especially important. Although an identifier doesn’t necessarily include a person’s name, it can be cross-referenced with other databases to link it to a specific identity. Thus, information that seemingly doesn’t identify anyone can end up revealing who a person is, where they’ve been, or what apps they use.

And if it’s possible to identify a person within that system, it may also be possible to recognize when they are about to receive an advertisement.

That’s where advertising becomes a mechanism for delivering exploits.

An operator who manages to identify their target within the advertising ecosystem can attempt to buy the ad space that person is about to receive and use it to deliver malicious content. If the browser or any of its components have exploitable vulnerabilities, simply loading the ad can trigger a chain of exploitation without the person having to click on anything.

This is particularly disturbing because it takes advantage of an infrastructure that is already installed across much of the internet and was designed precisely to find specific people and deliver content to them.

Cybercrime has been using malicious advertising, or malvertising, for years to distribute malware, redirect users to fraudulent sites, and run phishing campaigns. Recent research shows that these same capabilities can also be incorporated into highly targeted surveillance operations, including the deployment of mercenary spyware.

And the problems in the advertising ecosystem go far beyond malware.

For years we have known about research on the use of location data sold by data brokers to identify devices visiting sensitive locations, including reproductive health clinics. In a context of abortion restrictions, the possibility of associating these visits with specific individuals poses a very serious risk to people’s privacy and security.

To this we can add the manipulation of public opinion, scams, disinformation, the promotion of nudify apps —which we discussed in the previous edition— and many other forms of abuse that take advantage of the segmentation and distribution capabilities of digital advertising.

We turned the internet into a business by building a machine for collecting personal information, and now that same machine can be used to monitor, track, and even compromise people’s devices.

And here we believe there is an enormous responsibility on the part of the advertising industry.

The platforms that collect and distribute information, the intermediaries that participate in auctions, the companies that market profiles, and those who facilitate the delivery of advertisements are part of an infrastructure whose consequences can no longer be treated simply as privacy problems or unexpected uses of technology.

There are business and technical decisions that made these capabilities possible. There are companies that profit from them. And there are responsibilities that should be investigated, made public, and subjected to much stricter controls.

For those of us who work in digital security with civil society, these investigations also leave us with concrete tasks.

We need to take a closer look at advertising infrastructure, understand how it can appear in infection chains, look for its traces during forensic investigations, and promote strategies that minimize the information these platforms receive about people at risk.

Because blocking ads is no longer just about avoiding annoying ads or improving the browsing experience. It can also be a protective measure against tracking mechanisms and, in certain scenarios, against the delivery of exploits.

The internet ended up being funded by a system that needed to know more and more about our lives. Now we are seeing quite clearly what happens when those capabilities are made available to actors interested in something very different from selling advertising.

And perhaps it’s time to demand that the industry answer for the monster it helped to build.

And that being nothing more, Anomaly.

--[ Spyware ]--

Israel - Leaked messages reveal links between Netanyahu’s campaign and the media

A leak of WhatsApp conversations belonging to Jonathan Urich, an advisor to Netanyahu, revealed his exchanges with Amit Segal, one of Israel’s leading political analysts. Segal advised Urich on campaign videos and messaging, while Urich shared speeches Netanyahu was preparing. The leak also revealed another aspect of the matter: Urich allegedly exposed sensitive information using a media monitoring application he developed with AI and AI-generated code.

SEMAFOR

AdFection - spyware distributed through advertisements

A Citizen Lab investigation found that Discover-Tech, an Israeli company posing as an advertising provider, leveraged its infrastructure to facilitate spyware attacks. Its platform, Controlium, allowed attackers to target devices using advertising identifiers, cookies, and IP addresses, and to send malicious code whenever an ad appeared. Thus, what would normally have been a one-click attack could become a zero-click attack: simply displaying the ad was enough to initiate the infection. Researchers linked this technique, dubbed AdFection, to the infection of at least 45 Al Jazeera devices with Candiru spyware. They also identified a client apparently using Bindecy spyware in Colombia and Mexico, though they could not determine who was operating those devices. The analysis of nearly four billion advertising records illustrates the scale of the problem: Discover-Tech ads appeared on approximately 200,000 websites and apps. The everyday infrastructure of marketing ended up functioning as a conduit for surveillance and espionage.

Citizen Lab

XWorm expands its surveillance capabilities

XWorm has been circulating for some time, but the public leak of its code and builder in 2025 spurred new versions and increased activity. According to Netskope, detections quadrupled between the third quarter of 2025 and the same period in 2026. The interesting aspect of this evolution is that it’s no longer limited to stealing information; it now incorporates modules that can transform it into a surveillance platform, such as activating the microphone, capturing camera images, obtaining the device’s location, and controlling already authenticated browsing sessions, without needing to steal passwords or repeat multi-factor authentication. Netskope recorded activity particularly in Brazil and Panama, among other countries, affecting various sectors.

ThreatLabs

Android - Banking Trojans with New Remote Control and Surveillance Capabilities

Point Wild’s report for the third quarter of 2026 shows that banking Trojans accounted for 56.4% of the Android malware samples analyzed. Two recent families, RemControl and RatHat, combine credential theft with remote control, keystroke logging, and authentication code capture. RatHat incorporates AI-assisted navigation and can leverage wireless debugging to gain system access, while other campaigns are combining Trojans that relay contactless card data in real time for withdrawals and payments. Most of these infections originate outside of official app stores, with APKs disguised as banking or streaming apps, advertisements, and fraudulent calls that trick users into installing the app and granting accessibility permissions.

Point Wild

--[ Technical Analysis ]--

Coruna and DarkSword: New Adaptation Attempts for iOS 26

A NetAskari analysis describes Divine Seagull, a framework that borrows components from Coruna and DarkSword and attempts to extend its functionality to devices running iOS 26.0 and 26.1. The code includes several exploits under development, but much of it remains experimental and relies on older components that don’t appear to work on recent iOS versions. Among its components are attempts to exploit WebKit, take advantage of vulnerabilities in WebAssembly code execution, and bypass system protections. The framework also incorporates tools to collect cookies, browsing history, and data stored by the browser if other exploits fail.

NetAskari

--[ Digital Violence ]--

Latin America - Operations against child sex trafficking networks

INTERPOL reported the arrest of 95 people following four operations conducted between March and September 2016, involving 17 countries in Latin America and Europe. The investigations focused on messaging groups used to share and sell child sexual abuse material, with payments made in cryptocurrency. In Colombia, authorities rescued a five-year-old girl and arrested her father, accused of producing and selling abuse material. In Panama, the administrator of a group with more than 700 users was arrested; in Ecuador, device analysis led to the discovery of more than 4,000 files of this type. The cases illustrate different forms of violence perpetrated in digital spaces: production of abuse material, distribution of images, child grooming, and sexual extortion.

Interpol

Sextortion prevention company faces fraud lawsuit

The U.S. Federal Trade Commission (FTC) has filed a lawsuit against Digital Forensics Corporation and its owner, accusing them of collecting at least $60 million through deceptive promises of help from sextortion victims. According to the complaint, the company offered to track down perpetrators, gather evidence, and contact authorities, with packages ranging from $1,499 to $20,000, but in many cases, it failed to provide the promised services. The FTC also alleges that the company fabricated investigation reports, pressured people to purchase additional services, and posted fake positive reviews to conceal negative ones. This illustrates another type of exploitation surrounding digital violence: companies that present themselves as solutions for people in distress and exploit that urgency to charge them for help that, according to the complaint, they never receive.

FTC

Meta took several days to remove accounts reported for posting AI-generated videos of child violence.

In an investigation published on October 7, Futurism reported 19 Facebook accounts distributing AI-generated videos of violence against minors. According to the outlet, the accounts remained active for several days after being reported to Meta, which took more than 48 hours to respond and subsequently removed the content. The outlet documented that one previously deleted account had reappeared with its posts. We have already documented Meta ads promoting apps for digitally undressing minors in Anomalía; now we see that its reporting channels are also not the most effective.

Futurism

Xandr fined for sharing Grindr user data with advertisers

The Norwegian data protection authority fined Xandr, an advertising technology company acquired by Microsoft in 2021, 92 million Norwegian kroner for illegally transferring Grindr users’ personal data to advertising networks between 2018 and 2020. The information included device identifiers, IP addresses, and browsing data that, due to the use of an app targeting the LGBTQIA+ community, could reveal individuals’ sexual orientation. The company claimed it assumed Grindr had obtained consent, but the regulator determined that Xandr also had a responsibility to verify that processing this data was legal. In contexts where LGBTQIA+ people face discrimination, persecution, or violence, turning the use of a dating app into information for advertising profiling carries risks that extend far beyond personalized advertising. Once again, the advertising infrastructure emerges as a pathway for collecting and sharing sensitive information about communities that may be particularly vulnerable.

Estadao

--[ Cyberattacks ]--

Cuba - DoS attack against the database of political prisoners

Prisoners Defenders reported a denial-of-service (DoS) attack against its website and database of political prisoners in Cuba, which occurred minutes after the publication of its September 2016 report. The report documented a record 1,351 people imprisoned for political reasons or reasons of conscience. According to the organization, hundreds of IP addresses generated automated requests that overwhelmed its servers and temporarily disrupted access to the information. The organization stated that it managed to contain the attack and that there was no data breach or alteration. Although the source and perpetrators remain unidentified, the timing of the incident affected access to information used by family members, media outlets, and human rights organizations.

CiberCuba

--[ Surveillance ]--

DHS registered ICE observers in a Palantir database

Court documents indicate that agents from the U.S. Department of Homeland Security (DHS) recorded information on individuals observing immigration enforcement operations in Maine. The records included photographs, license plate numbers, and personal data, and were stored in Investigative Case Management (ICM), a system built with Palantir software. According to the lawsuit, at least six observers were recorded; some were labeled as potential threats, and their photographs were shared for facial recognition searches. The documents also describe warnings about potential inclusion on watch lists and the use of these records at border checkpoints. The government maintains that these were isolated incidents and denies maintaining a specific database of citizens protesting against ICE.

WIRED

A Russian operation used forged documents to influence schools in Peru and Ecuador

An operation linked to Russian actors sent fake instructions to schools in Peru and Ecuador, impersonating education authorities. In Peru, the proposal was to celebrate a supposed day of cultural diversity and include three Ukrainian political figures; in Ecuador, to organize a ceremony of support for Daniel Noboa and Erik Prince. Some schools followed the instructions and ended up becoming part of an operation that sought to introduce political messages into educational spaces. According to OpenAI’s analysis, those responsible used AI to write the content, translate it, and organize the work. The report also mentions activity targeting Argentina and Bolivia.

Dark Reading

--[ Ransomware ]--

Latin America - DeadLock combines stolen credentials, legitimate tools, and proxies on blockchain

DeadLock is a ransomware group active since July 2025, with documented activity in Argentina, Brazil, Colombia, Mexico, and Uruguay, among other countries. According to Cyble’s analysis, the operation uses compromised credentials and tools like AnyDesk to infiltrate computers, disable Windows defenses, and eliminate recovery options before encrypting files. One of its distinguishing features is the use of Polygon smart contracts to obtain the addresses of its intermediary servers: if an address becomes inoperative, they can update it without modifying the malware. Instead of publishing stolen data on a leaks site, as other groups do, they threaten to sell it on black markets.

Cyble

Qilin announces attacks on organizations in Mexico, Ecuador and Colombia in a few days

Between October 11 and 13, the Qilin ransomware group posted announcements of attacks against three Latin American organizations: Confipetrol in Colombia; ConAuto in Ecuador; and COMAPA Victoria, the municipal water and sanitation agency of Ciudad Victoria, Mexico. The cases involve business services, automotive distribution, and an essential public utility. In its posts, Qilin threatens to release information if an agreement is not reached. Ransomware is spreading in the region.

Brinztech Dexpose Ecuador Dexpose Colombia

--[ Exfiltradaz - Snapshot del 02/10/2026 al 16/10/2026 ]--

During this period, 17 references to leaks, compromised access points, and publications associated with ransomware were identified in three Latin American countries. Brazil had the highest number of observed records, with 13 references, followed by Ecuador and Uruguay.

Ransomware-related activity included posts about organizations in Ecuador, Brazil, and Uruguay. These included the Ecuadorian National Police headquarters, Santos Brasil (a port operator), and the Uruguayan Notaries Association. New authors observed during this period included akm69 and protonalien. The primary sources were niflheim, ransomware, and blackhatworld.

More details about these leaks at Exfiltradaz.

--[ ZOLIM --> Snapshot 10/16/2026 ]--

14 new and very interesting IPs for this ZOLIM snapshot. With these, we now have 299 servers detected since we started the observatory. :)

Some interesting signs:

• Mexico: We continue to detect Sliver, but this time we’ve moved beyond small towns and detected it in Mexico City.
• Colombia: Two important signs. The first is the proliferation of DCRat on IPs in Valledupar, likely related to Blind Eagle. We also found a curious Havoc in Cota, Cundinamarca. This location hosts several data centers, and in this case, the ASN hosting the malware belongs to Oracle. In Brazil, we observed the abuse of Oracle data centers, probably due to the free servers that work if they are located in the same country as the operation. Will this trend reach Colombia?
• Brazil: We detected a new instance of Cobalt Strike (Rio de Janeiro), and along with it, in the same ASN (AS402169), we found an instance of GoPhish (El Salvador). We also detected a new instance of Sliver in Goiânia. These two cases add to the trend we had already been observing of more sophisticated implants.

If you want to delve deeper, check out ZOLIM. In the table at the bottom, you can search and cross-reference data by country, ASN, IP address, threat level, city, and other fields. Every IP address is a good excuse to start investigating. :)