ADINT: Advertising Intelligence, Device Tracking and the New Spyware Delivery Ecosystem
ADINT (Advertising Intelligence) is the use of advertising-ecosystem data and infrastructure — bid requests, advertising identifiers, cookie matching, and device graphs — for intelligence and surveillance purposes, including target discovery, deanonymization, and tracking. AdFection is the first public technical confirmation of ADINT infrastructure being used to deliver mercenary spyware.
- Published
- 2026-10-15
- Last reviewed
- 2026-10-18
- Last updated
- 2026-10-18
- Evidence
- CONFIRMED
What ADINT is
ADINT (Advertising Intelligence) is the use of advertising-ecosystem data and infrastructure for intelligence and surveillance purposes. It sits alongside OSINT (open-source intelligence) and SIGINT (signals intelligence) as a distinct intelligence discipline built on the metadata that programmatic advertising exchanges about every device that requests an ad.
Components
- • Mobile advertising IDs (IDFA/GAID) — persistent per-device identifiers
- • Cookie matching — synchronizing identifiers across platforms
- • Device graphs — cross-device identity resolution
- • IP intelligence — geography and network identity
- • Bid-request metadata — device, OS, browser, app, location
ADINT vs related concepts
| Concept | Distinction |
|---|---|
| Ordinary ad targeting | Commercial relevance; ADINT repurposes the same infrastructure for surveillance. |
| Malvertising | Typically untargeted payload delivery through ads; ADINT enables target selection. |
| Network injection | Requires network-position advantage; ADINT rides existing ad infrastructure. |
| Traditional spyware delivery | Often phishing or one-click; ADINT enables zero-click ad-based delivery. |
ADINT and AdFection
AdFection is the first public technical confirmation of ADINT infrastructure being used to deliver mercenary spyware in the wild. The Controlium platform exemplifies ADINT: it uses advertising identifiers and IP addresses to select targets within the programmatic auction. See the AdFection pillar.
Confiant's concurrent ADINT research estimated roughly 10 million Discover-Tech ad impressions per day and documented large-scale identity vacuuming through cookie matching and first-party cookie theft — turning the ad ecosystem into both a mass-profiling tool and a stealth delivery vector.
ADINT: the "mass identity vacuuming" layer
Before an exploit is fired, the operator must know exactly what they are attacking. Confiant's research revealed the ADINT layer — a JavaScript engine masquerading as a standard analytics/verification SDK. Once loaded into the victim's browser, it performs deep environmental profiling.
4.1 Behavioral biometrics & fingerprinting
Mouse movement trajectories, click latency, keyboard keystroke dynamics, and scroll velocity.
Window visibility states, screen resolution, time zones, and WebGL hardware acceleration capabilities.
It reads accessible first-party and third-party cookies. In captured sessions, this included active session identifiers for logged-in corporate portals, proving the ad network can map a device to a specific corporate identity.
4.2 The mathematical uniqueness
By combining a 128-bit MAID, a 64-bit IP address, and high-entropy behavioral biometrics (mouse/click timing), the ADINT engine achieves near 100% uniqueness for the target's session. This allows the operator to:
- 01 Confirm the target is physically present at a specific IP.
- 02 Determine if the target is currently using their "high-value" device (e.g., the work laptop vs. a personal phone).
- 03 Wait for a specific app (e.g., Outlook, Edge, Signal Desktop) to gain foreground focus before triggering the exploit.
Last updated 2026-10-18
