❌

Normal view

Received — 17 October 2026 ⏭

Pluralistic: Israeli ad-tech company was a delivery system for "mercenary spyware" (17 Oct 2026)

✇Pluralistic: Daily links from Cory Doctorow
By: Cory Doctorow
17 October 2026 at 12:47


Today's links


A lonely country road with a large roadside billboard. Thrusting out of the billboard is a punching fist with bloody, spiked brass knuckles; it is surrounded by scabrous craters. The sky is a psychedelic roil of red-brown clouds, from behind which loom indistinct, vast tropical flowers.

Israeli ad-tech company was a delivery system for "mercenary spyware" (permalink)

More than half of all internet users have installed an ad-blocker; Doc Searls calls it the largest consumer boycott in history. As large as that boycott is, everyone – yes, everyone – should block every "programmatic" ad, because the entire system is so insecure that failing to do so could result in the total compromise of any or all of your digital devices.

That's the inescapable conclusion of Citizen Lab's latest blockbuster investigative report, "Exposing AdFection," which reveals how the largest ad-tech companies in the world, including Google and Facebook, allowed themselves to be hijacked by a "mercenary spyware" company that used the ad system to locate targeted individuals and serve "zero-click malware" that took over their computers and phones without them having to take any action:

https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

These tech giants amassed detailed surveillance dossiers on virtually every internet user, and they've assigned each of us unique, persistent identifiers, like a Social Security Number for spying. These companies also allow advertisers – or anyone pretending to be an advertiser – to serve blobs of code (which is all an ad is) to anyone based on those identifiers.

This allowed an Israeli spyware company called Discover-Tech (which masquerades as an ad-tech company) to sell totalitarian governments and sleazy corporate mercenaries the ability to pluck individual internet users out of the billions who log in every day and then serve "malicious ads" (that is, blobs of arbitrary code) to those targeted users. These malicious ads contained "no-click, zero-day" attacks, which meant that they exploited previously unknown vulnerabilities to take over devices without any user interaction. The mere act of loading a web-page or opening an app that relied on one of these gigantic ad-tech companies to serve ads was enough to compromise your device. No clicks needed, and no warning.

Among the targets of this attack campaign were the computers of workers at Al Jazeera. They were attacked with malware from the mercenary spyware company Candiru (which now calls itself "Integrity Labs" because irony is not dead). Beyond Candiru, Discover-Tech also facilitates attacks by numerous criminal mercenary spyware companies, serving ads on hundreds of thousands of sites and apps.

Discover-Tech was "certified" as a safe supplier by Google, Yandex, Microsoft, Beeswax (a division of Comcast) and IAB, the ad-tech industry's leading professional association. Ironically, Discover-Tech even attacked users by serving them malicious GDPR notices that appeared to let users opt out of commercial surveillance.

Because Discover-Tech was certified by all these industry bodies and firms, it had access to more than four billion ad-auctions, meaning that on billions of occasions, it was able to collect the identities of users loading apps and visiting websites, check them against the list of targets, and attack any victims it discovered through this dragnet.

Discover-Tech is an Israeli company with ties to other Israeli spyware and hacking companies, including via its board, whose members included Eric Banoun ("One of the pioneers of offensive cyber in Israel" –Haaretz). They have overlaps, relationships and affiliations with a rogue's gallery of Israeli companies, including the notorious NSO Group, who routinely sell cyber-weapons to the world's worst governments and whose products have been used to attack journalists, embassy workers, and activists.

The whole incident highlights the monumental insecurity built into the ad-tech industry, whose indiscriminate and voracious surveillance and manifestly insufficient vetting and security auditing now expose every internet user in the world to terrifying targeted attacks. These companies – including Google, a thrice-convicted monopolist whose surveillance tendrils are wrapped around the whole world – claim that they operate their networks with prudence and oversight. But the proof is in the pudding: for years, they've played host to a murderer's row of cyber-mercenaries who used their infrastructure to attack journalists and others.

The only way to avoid this is to block ads. This is easy enough to do in a browser (which is why the majority of internet users have installed an ad-blocker in their browsers), but it's illegal to reverse-engineer and modify an app so you can block the ads in it:

https://pluralistic.net/2026/07/21/dickovers/#block-element

Many websites run anti-ad-block scripts that push out nagging, guilt-tripping notices that call you a thief and a cheapskate for blocking ads. Ignore those notices: if a website is running "programmatic" ads that allow arbitrary third parties to spy on billions of people and target individuals for malicious device takeovers, they are charging too high a price to see their content.

Some sites go further: their notices demand that you either turn off your ad-blocker or pay for a subscription. This "pay or okay" scheme is illegal in Europe, California and other territories with strong privacy laws, and they are morally bankrupt besides. Privacy shouldn't be a luxury item and everyone deserves to be secure from cyber-attacks:

https://noyb.eu/en/noybs-pay-or-okay-report-how-companies-make-you-pay-privacy

This report also provides the most comprehensive rebuttal to a dangerous idea that refuses to die: that we should improve competition in the ad-tech sector by assigning every internet user a mandatory, government-issued advertising ID to "democratize" ad-targeting and followup (which the sector calls "attribution"):

https://pluralistic.net/2024/08/07/revealed-preferences/#extinguish-v-improve

Despite all this, none of it is an indictment of ads per se. The problem here isn't advertising, it's surveillance. The ad-tech sector has convinced advertisers that targeting ads to users rather than content will massively improve ad performance. The evidence for this is very poor: targeted ads improve clickthrough rates by less than 5% (relative to content-based ads that relate to the substance of the page you're looking at), and they're incredibly expensive (and very dangerous!) to serve.

On top of all that, surveillance-based ads shift power away from publishers (who know more about the materials they publish than any ad-tech company ever will) to spying ad-tech companies (who can spy on users in ways that no publisher could ever match). Whatever minor additional revenues surveillance advertising can wring out of the market are totally swamped by the cost of the ad-tech sector's own operations, which the ad-tech sector makes up for by grossly underinvesting in security and by colluding to cheat publishers and advertisers, charging more for ads and paying less to the websites that run them:

https://en.wikipedia.org/wiki/Jedi_Blue

If we want to improve competition in advertising services, the answer isn't to facilitate spying (which also allows the world's scummiest cyber-mercenaries to stage and serve targeted attacks). We should ban surveillance advertising altogether, restoring context-based ads to their role as the way that publishers make an honest living without selling out their audiences:

https://pluralistic.net/2023/05/31/context-ads/#class-formation

Hey look at this (permalink)


A shelf of leatherbound history books with a gilt-stamped series title, 'The World's Famous Events.'

Object permanence (permalink)

#25yrsago Linux on a Big Mouth Billy Bass https://web.archive.org/web/20010927153043/http://bigmouth.here-n-there.com/

#20yrsago No-Fly lists even stupider than suspected https://web.archive.org/web/20061019002553/http://rawstory.com/showoutarticle.php?src=http%3A%2F%2Fwww.cbsnews.com%2Fstories%2F2006%2F10%2F05%2F60minutes%2Fmain2066624.shtml

#20yrsago Canadian MP booted for his blog https://web.archive.org/web/20061026153747/http://www.cbc.ca/canada/story/2006/10/18/turner-caucus.html

#20yrsago Recording industry shuts out Brazilian legal scholars https://web.archive.org/web/20061103225020/http://www.a2kbrasil.org.br/ENG/SIGN-A-PETITION-FOR-AMENDING-THE

#20yrsago How pickpockets work https://web.archive.org/web/20070110023812/http://www.kiplinger.com/magazine/archives/2006/11/mystory.html

#15yrsago Why are more people opting for legal name-changes than ever before? https://web.archive.org/web/20111020163908/http://www.bbc.co.uk/news/magazine-15333140

#15yrsago Advice to the 1% from Lemony Snicket https://occupywriters.com/works/by-lemony-snicket/

#15yrsago Proposed Australian law makes it an offense to insult Gaming Minister Michael O’Brien https://web.archive.org/web/20120507161803/http://www.heraldsun.com.au/news/more-news/surely-this-is-a-joke/story-fn7x8me2-1226167552466

#15yrsago Aloha From Hell: Sandman Slim goes back to Hell and kicks more ass https://memex.craphound.com/2011/10/18/aloha-from-hell-sandman-slim-goes-back-to-hell-and-kicks-more-ass/

#10yrsago California DMV thinks “INFOS3C” is a dirty word https://www.techdirt.com/2016/10/17/california-dmv-rejects-1nfos3c-vanity-plate-because-sexual-connotation/

#10yrsago Howard Stern won’t release Trump tapes https://www.billboard.com/music/music-news/howard-stern-on-replaying-his-donald-trump-interviews-it-would-be-a-betrayal-7542079/

#10yrsago Kim Stanley Robinson says Elon Musk’s Mars plan is a “1920s science-fiction cliché” https://web.archive.org/web/20161018043554/http://www.bloomberg.com/news/articles/2016-10-17/why-elon-musk-s-mars-vision-needs-some-real-imagination

#10yrsago UK’s Investigatory Powers Tribunal says GHCQ illegally spied for 17 years https://www.theverge.com/2016/10/17/13305270/uk-illegal-surveillance-gchq-investigatory-powers-tribunal

#10yrsago Project Include cuts off Y Combinator because Peter Thiel is a part-time investor there https://web.archive.org/web/20161019043240/https://motherboard.vice.com/read/horrified-by-trump-silicon-valley-leaders-debate-cutting-ties-to-peter-thiel

#10yrsago Islamophobic terrorist cell planned a “bloodbath” in Kansas, wanted to kill Muslim babies https://web.archive.org/web/20161018144035/https://www.washingtonpost.com/news/post-nation/wp/2016/10/15/it-will-be-a-bloodbath-inside-the-kansas-militia-plot-to-ignite-a-religious-war/?utm_term=.a9d769256cf6

#10yrsago Everything Belongs to the Future: a tale of pharmadystopian, immortal gerontocrats https://memex.craphound.com/2016/10/18/everything-belongs-to-the-future-a-tale-of-pharmadystopian-immortal-gerontocrats/

#10yrsago UK government proposes issuing Britons with unique porn-viewing ID numbers https://www.openrightsgroup.org/blog/a-database-of-the-uks-porn-habits-what-could-possibly-go-wrong/

#10yrsago Donald Trump’s mail-servers are running Windows 2003 https://pluralistic.net/2021/10/18/labor-shortage-discourse-time/#core

#5yrsago Copyfraudster censors investigation of implausible covid gadget https://pluralistic.net/2021/10/18/labor-shortage-discourse-time/#copyfraud

#5yrsago Corporatism made John Deere ripe for a strike https://pluralistic.net/2021/10/18/labor-shortage-discourse-time/#deere-dash

Upcoming appearances (permalink)

A photo of me onstage, giving a speech, pounding the podium.


A screenshot of me at my desk, doing a livecast.

Recent appearances (permalink)


A grid of my books with Will Stahle covers..

Latest books (permalink)


A cardboard book box with the Macmillan logo.

Upcoming books (permalink)

  • "The Post-American Internet," a geopolitical sequel of sorts to Enshittification, Farrar, Straus and Giroux, 2027

  • "Unauthorized Bread": a middle-grades graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, April 20, 2027

  • "Enshittification, Why Everything Suddenly Got Worse and What to Do About It" (the graphic novel), Firstsecond, 2027

  • "The Memex Method," Farrar, Straus, Giroux, 2027


Colophon (permalink)

Today's top sources:

Currently writing:

  • “Once Is Enemy Action,” a science fiction novel about the origins of modern technofascism. Today's words: 563 (26602 total).

  • "The Post-American Internet," a sequel to "Enshittification," about the better world the rest of us get to have now that Trump has torched America. Fourth draft completed. Submitted to editor.

  • A Little Brother short story about DIY insulin PLANNING

This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.

https://creativecommons.org/licenses/by/4.0/

Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.

How to get Pluralistic:

Blog (no ads, tracking, or data-collection):

Pluralistic.net

Newsletter (no ads, tracking, or data-collection):

https://pluralistic.net/plura-list

Mastodon (no ads, tracking, or data-collection):

https://mamot.fr/@pluralistic

Bluesky (no ads, possible tracking and data-collection):

https://bsky.app/profile/doctorow.pluralistic.net

Medium (no ads, paywalled):

https://doctorow.medium.com/

Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):

https://mostlysignssomeportents.tumblr.com/tagged/pluralistic

"When life gives you SARS, you make sarsaparilla" -Joey "Accordion Guy" DeVilla

READ CAREFULLY: By reading this, you agree, on behalf of your employer, to release me from all obligations and waivers arising from any and all NON-NEGOTIATED agreements, licenses, terms-of-service, shrinkwrap, clickwrap, browsewrap, confidentiality, non-disclosure, non-compete and acceptable use policies ("BOGUS AGREEMENTS") that I have entered into with your employer, its partners, licensors, agents and assigns, in perpetuity, without prejudice to my ongoing rights and privileges. You further represent that you have the authority to release me from any BOGUS AGREEMENTS on behalf of your employer.

ISSN: 3066-764X

Received — 10 October 2026 ⏭

NYPD footage fuels scrutiny of ICE shooting

✇Salon.com
By: CK Smith
10 October 2026 at 20:02

Newly released NYPD body-camera footage showing the aftermath of an immigration enforcement shooting in New York City has intensified scrutiny of federal agents who shot a man with his 5-year-old son in the car.

The footage shows officers arriving Thursday in Marble Hill to find Oscar Belgal, 28, wounded, handcuffed and seated on the ground. NYPD officers rendered aid and rushed him to a hospital. Police later located his unharmed son with a family member.

Mayor Zohran Mamdani condemned the shooting in an initial social media post, saying Immigration and Customs Enforcement agents had shot a New Yorker while his child was in the vehicle.

This afternoon in Marble Hill, a New Yorker was shot by an ICE agent in a residential neighborhood. Early reports indicate agents surrounded him and a 5-year-old child in his car before firing multiple rounds. We believe the child was physically unharmed.

This is an unconscionable and incredibly serious situation. I have called the President; when we speak I will demand that he ends all ICE enforcement actions in our city. I will not stand by while ICE agents terrorize our communities.

Our thoughts are with the injured New Yorker and his family tonight. We are praying for his recovery.

Get ICE out of our neighborhoods. Get ICE out of our hospitals. Get ICE off our streets. Get ICE away from our children.

Abolish ICE.

— Mayor Zohran Kwame Mamdani (@NYCMayor) October 8, 2026

ICE defended the operation, alleging that Belgal, a Dominican national with a criminal record, accelerated his vehicle toward federal agents who feared for their lives. The agency also accused him of gang involvement.

On October 8, at approximately 4:00 PM ET, ICE officers were conducting a targeted enforcement operation in the Bronx, New York, to arrest a criminal illegal alien from the Dominican Republic with a prior criminal conviction for grand larceny, and multiple prior arrests for assault, robbery, possession of drugs, and weapons possession. He has associations to the Trinitarios gang, the same gang who brutally shot a CBP officer last year.

This criminal illegal alien was arrested by the NYPD on December 7, 2023, but was released into the community a few days later by reckless Democrat sanctuary policies that put American lives at risk.

During the incident, an ICE officer discharged his weapon and the criminal illegal alien was injured.

ICE officers immediately rendered aid. The individual is alive and at a local hospital. The FBI and HSI are on the scene. The incident remains under investigation. More information will be shared as it becomes available.

When dangerous illegal aliens are released back onto the streets by radical sanctuary politicians, our officers are forced to make arrests at large in the community in unpredictable and dangerous environments. Our officers should not have to risk their lives, and innocent Americans should not have to face unnecessary danger, because sanctuary politicians refuse to cooperate with federal law enforcement.

— U.S. Immigration and Customs Enforcement (@ICEgov) October 9, 2026

NYPD Commissioner Jessica Tisch said at least one federal agent fired seven rounds, striking Belgal in the neck. Surveillance footage shows armed, plainclothes officers approaching his vehicle but does not capture the shooting itself.

The incident sparked demonstrations across the city, including a Friday march from Foley Square to federal immigration offices in Manhattan.

Mamdani said he unsuccessfully appealed to President Donald Trump and Homeland Security Secretary Markwayne Mullin to release Belgal. He subsequently called for ICE’s abolition.

Start your day with essential news from Salon.
Sign up for our free morning newsletter, Crash Course.

Belgal’s attorneys said he was transferred to New Jersey after the shooting before being returned to federal detention in Brooklyn. A judge has restricted his transfer and temporarily blocked his deportation while his legal challenge proceeds.

New York Attorney General Letitia James called for a “full and transparent investigation conducted without fear or favor.”

The Bronx district attorney’s office is investigating. ICE has not publicly released its own body-camera footage of the shooting.

The post NYPD footage fuels scrutiny of ICE shooting appeared first on Salon.com.

Received — 1 October 2026 ⏭

America leaves Iraq, again

✇Vox - All
By: Caitlin Dewey
30 September 2026 at 23:00
Sign that reads If they return we will return
Iraqis gather in Baghdad to celebrate the withdrawal of US and international coalition forces on September 30, 2026. | Murtadha Al-Sudani/Anadolu via Getty Images

This story appeared in Today, Explained, a daily newsletter that helps you understand the most compelling news and stories of the day. Subscribe here.

The last US troops in Iraq formally withdrew today, 23 years after the United States first invaded Iraq and 12 years after it returned to take on the Islamic State. It’s a historic occasion, by many accounts — but also a pretty low-key one: The US has steadily scaled back its presence in Iraq for years as part of a phased drawdown inked by the Biden administration. 

That drawdown represents the end of a long (and often, ugly) chapter in US military history. The US and its allies deployed tens of thousands of troops to Iraq as part of the larger war on terror that started in 2003. 

Those troops left Iraq in 2011. But a smaller contingent returned three years later to stamp out the Islamic State, a violent jihadist group that had gained a major foothold after Western forces left the country. 

Neither campaign was particularly popular with the American public in the end, and more than 4,500 Americans have died in Iraq in the past 20 years. Large numbers of civilian casualties, as well as drone strikes that were seen as violations of Iraq’s sovereignty, have also fueled periodic Iraqi protests against American intervention. 

As the US withdraws, however, it’s leaving behind some very loose ends. Loose ends that, as we’ll see in a minute, ultimately benefit…Iran.

Go a little deeper

Don’t quite believe me? Just look at how Iran’s allies are celebrating today’s news. The commander of one Iranian-backed militia in Iraq called the withdrawal “a crushing defeat for the American project.”

Both Iran and the United States have spent the past 23 years attempting to shape the new Iraq. Historically, Iran and Iraq were bitter rivals — an enmity probably best demonstrated by Saddam Hussein’s 1980 invasion of Iran. 

After the US toppled Hussein in 2003, however, Tehran redoubled its efforts to build political and military clout in the new Iraqi state. It strengthened ties with figures like Hadi al-Amiri, whose Iran-backed Badr Organization has become a major force in Iraqi politics. It poured hundreds of millions of dollars into soft-power projects, like expanding Shiite pilgrimage sites in Iraq. And it funded, equipped, and trained a number of powerful paramilitary groups.

Some analysts have warned that the final withdrawal of US troops could embolden Iranian-linked groups in Iraq. That also seems to be a concern on the ground, where ordinary Iraqis have told reporters they fear their country “could be swallowed up” by groups linked to Iran.  

Already, the Iraqi government has pushed back the deadline for Iranian-backed militia groups to disarm. It was originally supposed to happen on the official date of the US withdrawal — today.

It’s an inglorious ending, all told — and a sobering lesson on the limits of American power. The US may have the resources to handily win any military spat it gets itself into. But securing a desired political outcome is a different and more time-consuming project altogether.

It doesn’t help that US rivals like Iran seem very willing to play the long game. By dipping in and out of places like Iraq, the US may risk giving Tehran more openings. 

One link for later

➨ Don’t throw out that old receipt! It — along with the political mailers, ticket stubs, business cards, product packaging, and other printed ephemera you encounter in your day — is perfectly suited to the newly viral hobby of junk journaling. It can be a powerful creative practice and the ideal antidote to doomscrolling.

Before you go…

  • Did you know…that your sense of touch peaks in your late teenage years, and declines gradually from there? It might be one of the reasons that elderly people are prone to falls.
  • Today’s trivia: Where was Napoleon exiled to after his forced abdication? (You can find this and other brain puzzles in Vox’s daily crossword. Look for the answer in tomorrow’s edition.)
  • Yesterday’s trivia: We asked you for the origin story of civil rights icon Ruby Bridges. She was the first Black child in the American South to attend an all-white elementary school, and she went on to start a foundation devoted to tolerance. 
❌