Today I learned that Andy Ngo has written a book about the Zizians.

Everything about that sentence is deeply, deeply cursed.

"This report exposes zero-click spyware delivered via targeted ads, which we call AdFection, and is the first technical demonstration that mercenary spyware is being distributed via targeted advertisements."

True. All of the other examples I can think of involve govts that roll their own malware.

Additional highlights from the Citizen lab report include:

"Discover-Tech...also leveraged the European General Data Protection Regulation (GDPR) consent frameworks to target users within the European Union."

https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

If you would like a good laugh, please note that Candiru has changed its name to "Integrity Labs."

Citizen Lab finds Candiru's mercenary spyware on the phones of Al Jazeera journalists, infected using Discover Tech to deliver the malware using targeted ads. https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

ChatGPT now lets you target ads based on specific prompts or any phone number or email address. This is absolutely 100% going to be used for harassment.

https://www.404media.co/how-chatgpt-targets-ads-to-you-based-on-your-prompts-phone-number-and-email/

Elevation Lab pulls its AirTag silencing tool. Good things can still happen, occasionally through the power of shame. Kudos to @glennf on this one: https://www.elevationlab.com/blogs/news/an-apology

RE: https://mementomori.social/@maijanlainen/117435589734913543

My Mastodon replies continue to be very cool and normal.

so @kimzetter absolutely killin it today reporting on implants in crypto wallets - including some from authorized sellers.

https://www.zetter-zeroday.com/who-is-planting-backdoors-in-ledger-crypto-wallets/

https://www.zetter-zeroday.com/trezor-wallets-also-compromised-with-implants/

A lot of people I know shared posts about the Yandex datacenter bombing resulting in a decrease in Russian misinformation/disinformation bot activity, sometimes with charts. Let this be a reminder every one of us could be fooled by a story that we really want to be true.

RE: https://hachyderm.io/@evacide/117412045251981085

I have now heard from several maintainers of open source projects who tell me that this is something they specifically asked for and/or that it is a big improvement on the status quo, so this hot take was wrong.

@evacide TBF we were getting those emails anyway and the Glasswing reports are both higher quality and come with .patch files as starting off points for fixes. The reports even triage the issues rather than report everything as a level 9 CVE.
As far as damage limitation goes then, it takes the edge of all those people with claude max subs who want CVE fame and for whom claude has replaced metasploit cli as the only security tool they know

I understand that Anthropic thinks they're doing open source projects a favor here, but what they're actually doing is creating an enormous amount of work for people that they are not paying.

https://www.anthropic.com/research/launching-opt-in-vuln-finding-service-for-open-source

Another example of the ways in which misbehaving agents have affected the digital commons and some thoughts about what should be done about it.

"While OpenAI admits to agents behaving 'unpredictably', they must also acknowledge their responsibility to monitor and prevent these risks. AI companies are not doing enough to secure their systems and protect the public from the harm they cause. That burden is falling onto everyone else, including smaller organizations. At a minimum, their systems should operate in a way that non-profit website owners like us can easily identify, and choose how they interact with our services."

https://wikimediafoundation.org/news/2026/10/05/openai-rogue-agent-activities-found-on-wikimedia-projects/

Pervert glasses: now even more explicitly designed for abuse!

https://futurism.com/artificial-intelligence/influencers-promoting-cheap-dupes-meta-glasses-light

We are going to use AI to file public records requests. Then we are going to use AI to reply to the public records requests. Then we are going to use AI to write news stories about the public records, which will be read by more AI. No action will be taken. #civictech

"AI is going to help government transparency by making it easier to file public records requests!"

"Oh no."

https://techcrunch.com/2026/09/10/ai-agents-are-flooding-public-services-with-new-requests/

Today's privacy and security guide:

Connected Cars: Privacy and Security for Survivors

https://www.techsafety.org/connected-cars-privacy

I need something that zaps me with a painful shock whenever I spend too much time doomscrolling on my phone.

*tendonitis has entered the chat*

Oh no.

I have spent much of this week doing the sort of work that AI is absolutely terrible at, which has helped me to see how many people doing this same work are definitely using AI.