Keep an eye on this Google Adwords ruling in India... could have significant impacts on search targeting if Google is required to change policies outside of India too... www.reuters.com/business/med... This would be a *gamechanger* for stopping malvertising campaigns which target major brand names.

How many of your favorite publishers have foreign data brokers listed in their ads.txt + app-ads.txt files?? Folks out here are still wondering how this data pours out of our programmatic ecosystem into these brokers hands. ¯\_(ツ)_/¯

I've been dreading this announcement for weeks. This is one of the most shocking things I've seen from any administration in any country. This whole process would make most dictators blush.

The Former Jordan Lake Air Force Space Surveillance Station (AFSSS) in Alabama is available for purchase until May 11th... a great opportunity for a 1,032 +/- ft horizontal antenna if you're in the market for that type of thing... fun hacker campground? realestatesales.gov/asset-detail... 📡🛰️🏕️🎉

Excellent reporting, alarming findings. Bloomberg's @dmehro.bsky.social et al found U.S. state government health websites are sharing people's personal info (sex, citizenship & race data) with tech giants via pixel-sized webpage trackers. Several states pulled the trackers after Bloomberg disclosed.

the calm before the storm

It's taken ~5 years but Brave browser is the first browser to come up w/ a solution to prevent device fingerprinting being done by y2u[.]be on their YouTube spam campaigns. It's a subtle fix but the browser now takes their URls and rewrites to youtube directly. issue @ github.com/brave/brave-...

Jealous of Maryland rn

Canary in the privacy coal mine ⬇️

Antitrust laws continue to be ignored, broken, and bent to suit a political agenda. The fact that Dentsu, GroupM and Publicis didn't fight back on this speaks volumes about what they are going to do with client ad money in the future. 💸💸💸 www.texasattorneygeneral.gov/sites/defaul...

It's one thing to collect data on us everywhere we go, but it's quite another to tie all those tidbits back to a single identity (you). Today @thezedwards.bsky.social and Iesha White explain just how bad it is and how you can try to avoid it. podcast.firewallsdontstopdragons.com/2026/04/13/i...

Advertisers and advocacy groups have a right to share their opinions about brand unsafe networks and big ad tech companies. These witch hunts have gone on far too long.

Congrats to everyone in Hungary! What amazing news for the world.

👀Coming Monday!

🎉

Good morning to everyone but botnet admins! Great piece from @mattkapko.com, appreciate having a few of my comments in it! 🖖🌩️⚖️ cyberscoop.com/botnet-disru...

I suspect TTD would have more auditor advocates for supply path cleanups if they made it a requirement to expose the supply chain object client side. As it stands, only ad tech organizations get this data server side, and the amount of research about flipping traffic is minimal because of it.

Great reporting ⬇️⛈️⚖️

👀⛈️⚖️

www.bloomberg.com/features/202... "That December, Core obtained a warrant to mount a 24-hour surveillance camera outside Curtis Cores, installed surreptitiously on a utility pole along Highway 51."... " They would uncover the story of a dark supply chain that saw $545 million in cash..." 🌩️⚖️

⛈️⚖️🖖🏻

I also had a nice video call with Meg Whitman and some folks on her team when this research came out. There was some very interesting shenanigans being conducted by one of their vendors that I found and they immediately went 10 alarm fire on them about it. Was a solid response plan imo! 🖖

just reported another subtle email address data supply chain breach to a major corporation who yeeted my email to their vendors due to a dumb URL structure -- this problem always comes up! some of my previous research on it: www.nytimes.com/2020/04/29/b...

We need to dramatically improve ad libraries as a core way to slow down scams.

that feeling when you finish and publish the massive client report you've been working on for ages right before the new year

As both the House & Senate look to repeal Section 230, I'm curious who they think should be held liable for the comments they've left open on the Epstein photo dump...? Them? Dropbox? Do they have a trust & safety team watching the comments?

My Youtube account was unsuspended but the video in question is still private. Based on their vague feedback it seems possible that YouTube now has a tool to scrape videos for URLs (like from my screen sharing research session) and then flag videos which in any way reference a known malicious URL.

Today our team at @silentpush.bsky.social released research we’ve been working on all year – a magnum opus 39-page report on the state of Bulletproof Hosting Providers. Brief thread with some details Read the report @ www.silentpush.com/white-papers...

We found the bug in how Vetco generates PDF documents for its customers. Its PDF page was public and was indexed by Google, which is how we found it. Worse, an IDOR bug in the URL meant it was possible for anyone to obtain customer data by changing the customer's unique ID by a single digit. 🤦

Found a "great deal" in about 30 seconds of hunting -- 1k abuse reports on YouTube for $100 - a mere 10 cents per report! This is the type of bot farm product that shit birds use when they want to harass researchers and other folks.

YouTube suspended my ~15+ year old account and all my videos due to a video I recorded about scammers targeting US government and military offices, which was embedded into articles like @ www.vice.com/en/article/w... from @josephcox.bsky.social I was likely targeted by a mass reporting campaign.🤡

The new *free* FireFox VPN which has been tested for months (windowsreport.com/firefox-is-t...) is likely on the horizon for a wider release based on recent comments that a VP / head of Product at Firefox made on Linkedin. Google couldn't even get a free VPN + abandoned their $$ "Google One VPN"

SS7 is gonna remain a dumpster fire security threat and China will continue to exploit it if we can’t even have simple cybersecurity requirements for the telecom industry.

a 5+ year old bug ticket was finally closed by Google - this was actually the last significant investigation into Chrome extensions that I did because the feedback loop was so challenging definitely still a place with research opportunities and threat actors regularly doing weird stuff! 🖖

Everything about this piece from Reuters about the scam ads on Facebook is wild -- internal Meta estimates noted they were showing these scams 15 billion times per day, scammers are not banned just forced to pay more for ads, teams internally restricted, must read: www.reuters.com/investigatio...

fun to see my mom in this crowd shot from the No Kings rally in Houston featured by the Houston Chronicle @ www.houstonchronicle.com/projects/202...

Has anyone ever successfully received data from a personal Yandex data access request? Essentially receiving what data they collect on you as required under a bunch of privacy laws?

I’ve got this 100+ year old copy of an old play about Abraham Lincoln’s life which was owned by someone named Alden Nash who had an interesting personal emblem that he screen printed & glued onto the cover page. The play was shown at the Birmingham Repertory Theatre then the Hammersmith Playhouse.📚

Our team @silentpush just dropped a definitive look at SocGholish (operated by TA569) and the initial access broker ecosystem they are facilitating. Big thanks to past researchers who have worked on SocGholish! We've got details about our visibility @ www.silentpush.com/blog/socghol... 🖖🏻

If I’ve been quiet you know I’m cooking up some fire research! Our team at @silentpush.bsky.social is out today with a big report about the admin / owner of the FUNNULL CDN – essentially a dox of all his accounts and activities on the internet for the last 15+ years.

"Funnull had direct exposure to Huione Pay, for which the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) recently issued a finding and notice of proposed rulemaking (NPRM) identifying it as a primary money laundering concern" 👀

More on Funnull in this Silent Push report from January: www.silentpush.com/blog/infrast... These are also Funnull IPs and domains: bsky.app/profile/camp...

NEW: The U.S. government has announced sanctions against FUNNULL and its administrator. FUNNULL is accused of providing infrastructure for pig butchering crypto scams, as well as being the company behind the Polyfill supply chain attack, which pushed malware to victims who visited certain websites.

The last 6 months I've traveled around the world giving presentations on FUNNULL about the scams and money laundering they are facilitating -- and today -- the U.S. Treasury has sanctioned FUNNULL and we got a bunch more facts about the operation now public. home.treasury.gov/news/press-r...

The location data they will be selling will primarily be powered by Google and Apple’s Mobile Advertising ID schemes - combining that with new data lakes trying to connect scraped social media content to IPs and MAIDs is truly connecting the dots on dystopia.

Adage is out with a new piece today about a data broker product targeting people in Saudi Arabia which doesn't make *any* sense to me. I provided pushback but my comments wern't include -- the piece is "How Coke used an AI agent to target ads to 828,000 fast-food fans" adage.com/technology/a... 🧵

21 year-old money launderer for a $265 million crypto theft ring was helping members exchange crypto for cash and mailing $25k in cash through the mail put inside "Squishmallow" stuffed animals www.cnbc.com/amp/2025/05/... 🫧🐰

Wow what a mess

It's 2015. President Barack Obama has accepted a "sky palace" jumbo jet from the Qatari government, which he'll own after he leaves office. "Everybody relax," he says in an interview with the New York Times. Everyone does. The networks then televise the military parade in his honor on his birthday.

mouse jail is a weird way to encourage accidental clicks victorymedium.com/mouse-jail/