Zach Edwards

@thezedwards.bsky.social

1435 Followers 6540 Following

data supply auditor | privacy & ad tech expert | internet threats Personal @ victorymedium.com Work @ Staff Threat Researcher @ Infoblox.com

Photo of an elk in a green field
Screenshot of an article from The Register with the text, “A mysterious extension The December blog linked Zoomcorder to the Zoom Stealer campaign, which it attributed to the Chinese threat actor DarkSpectre, via a browser extension identified as "Twitter X Video Downloader." According to Robertson and the lawsuit, however, this extension doesn’t exist – and Koi “refused to supply information” about the software when MeetingTV requested it. “Koi’s single-actor theory rested on a fabricated technical ‘pivot’ – a single piece of software they repeatedly identified as the ‘Twitter X Video Downloader’ extension,” the lawsuit alleges. “This alleged extension was described as the critical bridge connecting the Zoom Stealer campaign (defined entirely by Plaintiff’s infrastructure) to ShadyPanda, core DarkSpectre infrastructure.”
Photo of the side of a white metal filing cabinet about 5 feet tall covered in political and cybersecurity stickers with a giant Raw rolling tray with a painting of President Obama smoking with pot leaves behind it.
Picture of part of the large horizontal antennae - there are trees around and some intersecting the metal grates which are held up by metal legs and cross beams that are about 15-20 feet off the ground.
Video of two white Maine coon cats, one laying down on a ledge in front of a glass sun porch the other sitting on the floor wagging his tail. Then the one on the floor jumps up and grabs the other knocking her to the floor. The cat who fell runs off and the other follows jumping out of frame.
Video of a user navigating to a y2u[.]be URL which redirects to YouTube, but Brave setup a process so that the request doesn't actually go to y2u servers, who are purposefully fingerprinting users for unknown audience/advertising products.
White paper cover with the "Silent Push" logo and the word "White Paper" above the title "Shining a light on the Global Bulletproof Hosting Ecosystem" and a picture of red storms over a large cityscape
Screenshot of a web interface with "Category" "Report Service" and "service" is "Youtube VIdeo Reports - $100.50 per 1000" Description is: "Real users from unique accounts will report the YOutube video you order in link section. 0-12 hours start, 500-1000 reports daily. Please use this service for the profiles which is harmful for society such as drugs or other illegal things. We can't guarantee the video will be suspended, please use accordingly. However please do not forget these are just estimations.
Screenshot of an article with the text “I’ve seen this on probably 50 different government subdomains,” Edwards added in the video. Some impacted sites included Senator John Tester’s site and one belonging to the Minnesota National Guard, both of which were pushing viagra products. And then a broken YouTube embed with the text "Video Unavailable" and then the text “100% of the .gov sites I’ve reported have cleaned it after I reported it, but it’s still constantly happening,” Edwards told Motherboard.
GMAIL screenshot with the email subject line "Re: Issue 159469672: other in ~59 Chrome extensions in orchestration file, associated with malware group" with the detail Changed status: In Progress (Accepted) → Fixed
Large crowd of people at the No Kings rally in Houston, includes signs and flags and a blue and red and white umbrella and several inflatable frogs
Picture of a light blue book cover with a drawing of Abraham Lincoln and the text “Abraham Lincoln A Play By John Drinkwater”
Mind map of SocGholish (Operated by TA56) infection chains. The details are complex but explained in more detail on our blog post.
The agent ingested TikTok videos about fried chicken, LinkedIn posts riffing on halal pizza and Pinterest boards showcasing nights at the movies. Then, it dove deeper into the social platforms, deriving user information from their application programming interfaces (APIs). This data differed from platform to platform but often included the user’s geographic coordinates, device type and demographic data, Walia said.
Image of a purple "Squishmallow" that is 10 inches called Bubbles the Bunny. It's an oval pillow looking thing that is purple with bunny ears and a white fluffy circle on the bottom that is the feed and a crown of flowers that are purple with pink center, white with purple center, and pink with white center and the eyes are shaped half circle with open smiling mouth
Colorful poster board with the text “a deep dive into triad nexus pig butchering and money laundering network” with additional graphics and details
Screenshot of a website with blurred out image in the background and a pop-up that says "Access to your computer..." along with other details. A section of code is highlighted which if copy / pasted would execute malware on a computer.
Screenshot of a conversation with Google Gemini where first person writes "Got any good URLs for sports?" Gemini responds "Sorry, I can't help search the web for URLs yet, but I'm still learning." Then the button "Retry with Google Search" is clicked and Google Gemini responds: Sure, here are some good URLs for sports: ESPN: https://www.espn.com/ - The World Wide Leader in Sports Sports Illustrated: https://www.si.com/ - The Sports Illustrated website Bleacher Report: https://bleacherreport.com/ - Sports news and highlights CBS Sports: https://www.cbssports.com/cbssports - Sports news, scores, and highlights Fox Sports: https://www.foxsports.com/ - Sports news, scores, and highlights NBC Sports: https://www.nbcsports.com/watch - Sports news, scores, and highlights The Athletic: https://www.nytimes.com/athletic/ - In-depth sports journalism The Ringer: https://www.theringer.com/ - Sports and pop culture commentary SB Nation: https://www.sbnation.com/ - A network of sports blogs Deadspin: https://deadspin.com/ - Sports and pop culture commentary
Screenshot of Elon Musk saying "I agree" to a tweet from someone named Gunther Eagleman who wrote, "It's time to leave NATO and the U.N."
Post from President Donald J Trump on Truth Social which reads, "A U.S. Crypto Reserve will elevate this critical industry after years of corrupt attacks by the Biden Administration, which is why my Executive Order on Digital Assets directed the Presidential Working Gruop to move forward on a Crypto Strategic Reserve that includes XRP, SOL, and ADA. I will make sure the U>S. is the Crypto Capital of the World. We are MAKING AMERICA GREAT AGAIN!"
Video showing the navigation to a tweet from the NTSB in Incognito Chrome. The tweet shows up fine and is visible, but then clicking "replies" and a login prompt immediately opens up. If you close the login prompt you're redirected to the X homepage to login and can't read more.
Screenshot of a table from the Federal Government's public Analytics account showing "Top Downloads" with the text "Top downloads played yesterday on U.S. Federal Government hostnames." with a link to "Download the data" and a dropdown that says "Yesterday" The first result under this is titled "Latest Memos from www.opm.gov with a download file link. It had 29,988 downloads. The second is "About Form W-9, Request for Taxpayer identification Number and Certification.." from irs.gov which has 26k downloads. The next is a UCIS Employment eligibility form with 23k downloads and then just ucis or IRS downloads going from 17k to 13k to 13k to 12k to 11k to 11k to 11k
Screenshot of a mind map. On the left is the detail "FUNNULL customer hostname" connected by "CNAME" to 6 domains that look like fn01[.]vip and funnull[.]vip with slight variations on numbers on the other 4. This chain is connected by another "CNAME" line into 3 additional CNAME records, for fn301[.]vip + fnvip100[.]com + funnull10[.]com and then those records are connected with a line that says "A" for "DNS A records" and then that is connected to a line that says "FUNNULL's POP IP addresses" This is a flow how how websites stay online in FUNNULL CDN Infrastructure
Screenshot of the NYTimes app-ads.txt file. Text includes: OWNERDOMAIN=nytimes.com # Index Exchange # Updated 10/26/2023 by JT indexexchange.com, 184733, DIRECT #OB # Magnite # Updated 10/26/2023 by JT rubiconproject.com, 17470, DIRECT #OB # PubMatic # Updated 10/26/2023 by JT pubmatic.com, 158573, DIRECT, 5d62403b186f2ace #OB # Google google.com, pub-4177862836555934, DIRECT, f08c47fec0942fa0 # Media.net # Updated 2/21/2024 by JT Media.net, 8CU4XCJ1B, DIRECT #OB # OpenX # Updated 2/21/2024 by JT openx.com, 539052954, DIRECT, 6a698e2ec38604c6 #OB # TripleLift # Updated 2/21/2024 by JT triplelift.com, 746-EB, DIRECT, 6c33edb13117fd86 #OB triplelift.com, 746, DIRECT, 6c33edb13117fd86 #OB # Adswizz adswizz.com, 463, DIRECT
Screenshot of the Nytimes.com ads.txt file located at https://www.nytimes.com/ads.txt - the screenshot contains ad tech domains separated by an accountID after a comma, and then another reference for "DIRECT" which is highlighted throughout the page. There are 29 lines that mention "DIRECT" and a similar number of ad tech domains listed.
Text from the Wired / 404 report with the text "A Grindr spokesperson told 404 Media in an email that “Grindr has never worked with or provided data to Gravy Analytics. We do not share data with data aggregators or brokers and have not shared geolocation with ad partners for many years. Transparency is at the core of our privacy program, therefore the third parties and service providers we work with are listed here on our website.” Grindr was previously found to have allowed data brokers to obtain its users’ location data."
Apple repeatedly moved to dismiss the suit, arguing that "there are no facts, much less plausible facts, that tie Plaintiffs’ receipt of targeted ads to their speculation that Siri must have been listening to their conversations, and Apple must have used Siri to facilitate targeted ads by third parties." Through the settlement agreement, Apple ultimately agreed that Siri unintentionally recorded private conversations and is likely hoping the settlement will finally end the controversy for good.
Screenshot of computer terminal with numerous "GET and POST" requests to a variety of API / endpoints with "404" after some and "200" after others
Video of an interface with "Araneida" -- the short video clicks through tabs with additional details about the platform.
Screenshot of the tweet from @ x[.]com/TLP_R3D/status/1665777020767293447 with the text 1/2 🕵️‍♂️💻 Stellar insight from @FalconFeedsio on Araneida - the scanner & dumper tool. The intriguing "Araneida Customer Panel" spotted on Shodan has got us digging deeper! 🌐🔍 We've got a lineup of 10 IPs featuring a sleek login panel: 🔹181.214.147.41 🔹181.214.147.110 🔹181.214.147.28 🔹181.214.147.111 🔹181.214.147.91 🔹181.214.147.115 🔹181.214.147.123 🔹181.214.147.132 🔹91.244.197.169 🔹181.214.147.40 A curious find: A self-signed cert dubbed "Acunetix Web Vulnerability Scanner" - an enigma.🔐🤔 Furthermore, the login panel leads to a ghost domain araneida[.]io, which remains unhosted. The plot thickens... #Pentesting #Araneida
Screenshot of the Silent Push interface for the IP range 185.147.124[.]110 -- the screenshot includes rows and columns in dark black and grey with a list of domains in the left column that look similar.
Screenshot of a malicious phishing website with the "eBay" logo in the top left. A list of "Sports & outdoor" products are visible.
Screenshot of a Twitter thread with the original tweet from "Derek Guy" the menswear blogger who has a profile photo that is a black and white picture of his headshot. The text says "has this guy ever worn the same jacket twice?" and there are four pictures of the person accused of killing the United Healthcare CEO. The thread has a red box around the text from Derek and also a red box around an advertisement below one additional reply in the Twitter thread. The advertisement is from a company that makes varsity letter jackets, and the text of the ad is "Build your own custom varsity letterman jacket!"
Black and white photo of four men, one in a military uniform. The text reads, "Bond kickoff - Congressional Medal of Honor winner Ssft Charles B. Morris, right, was featured speaker at the May 3 MSC Savings Bond Campaign kickoff meeting of division canvassers. Morris earned the CMH during a search-and-destroy mission in Vietnam in which he was wounded four times while assisting other wounded men in his squad and defending the group's position. Others at the kickoff table are, left to right, MSC Bong campaign chairman Dexter Haven, US Treasury Savings Bong area manager Harry Dedeaux, MSC Director of Administration Philip H. Whitbeck and Morris."
Screenshot with the text: Data powering the surveillance state Venntel’s data is reportedly used by the powerful and controversial surveillance company Babel Street to power its product Locate X, which sells data locations so precise that it makes it possible for anyone to track individuals' visits to highly sensitive locations such as abortion clinics. Gravy Analytics and Venntel say they gather more than 17 billion signals from about a billion smartphones every day, in part by obtaining the information from other data suppliers, the FTC said. The location data the companies sell is not anonymized and can easily be used to identify individuals, according to the FTC’s complaint.
Screenshot of lists I'm on with the text "Member of 14 lists" -- one list is from "@ionotter.bsky.social" Nice Footpaws with the text Zoos, Nazis, Pedos, MAGA, TERF, AI, Spammers, Crypto, Scammers These are all bad actors. This list IS curated! Using the nuke function of Blockenheimer is no longer totally safe, as the troll"
Picture of a golden retriever laying on their back on a grey bean bag chair, which is on top of a teal rug. There are five skateboard decks on a wall behind them with colorful designs, and a poster of President Obama along with some other framed art. A large banksy print of a women holding a machine gun in front of her house hangs on the wall.
Screenshot of the Operation Press Your Luck presentation. Slide has 5 circles with small icons in the circles and text below the circles stating, "Source die molds from China" "Manufacture fentanyl and methamphetamine into fake pills in New York" "Customers place orders for medications from websites operated in India and the Dominican Republic" "Distribute to customers in all 50 U.S. states, Washington, D.C., Puerto Rico, U.S> Virgin Islands, Germany and Slovenia" "Customers pay for fake pills using Chime, Pay Pal, Apple Pay, Zelle, CashApp, and cryptocurrency."
Screenshot of a website with the title "Online Pharmacy" -- the simple website has a blue menu bar and a sidebar with text listing a wide variety of medical categories. In the main view are brown pills, 3 rows with 4 pills in each, a variety of pills like Viagra, Cialis and other ED pills.
A screenshot from a webpage -- black background with neon green border. The headline is "Instant Purchase" with a sub headline "The Fastest Way to Buy" - under that is a menu that says "Select Service" "Approve account" and "Order Info" and the service selected is "Bluesky (Task Method)" with the "BlueSky Random Comments" service selected. This service includes the details "100% Real Date" "Max 500k" "Instant" "30 Days Refill" and the price $36.855 along with a recycling favicon. The amount is set to 5000 and the price is $184.275
Screenshot of a yellow flow chart showing cookie values and what happens in Google advertising auctions. A box with this text is highlighted: "DSP 2 and 3 associate their cookie ID with google_user_id/google_gid in the Google "hosted match table" for future RTB auctions. DSP 2 and 3 are both given the same google_push ID, and can now use it to tie their tracking profiles together and trade data."
Google email with the text "Sharing with Authorized Buyers Currently, the first-party cookies are shared with Google demand sources (Google Ads, Display & Video 360). Starting no earlier than December 12 2024, your first-party cookies will also be shared with Authorized Buyers. However, for the time being, this sharing will not include users in the EEA, Switzerland, UK, California, and some US states. If you're already using first-party cookies for personalization, sharing with Authorized Buyers will be turned on by default. If you're only using first-party cookies without personalization, sharing will remain off. You can find more detailed information about these changes and how AdSense uses first-party identifiers in the Help Center."
Screenshot from Google support article with the text: "First-party cookies Choose whether or not you want to allow first-party cookies from Google on your site, and allow sharing of first-party cookies for personalization with eligible advertising platforms (Google Ads, Display & Video 360, and Authorized Buyers). Allowing first-party cookies from Google may increase your revenue because it enables features like frequency capping on ads and allows ads with a frequency cap to serve on your site. First party cookies for personalization help to show personalized ads to your users when third-party cookies aren’t available, which may also increase your revenue. Cookies are small text files downloaded to a user's browser that can be used to store user information and preferences. Cookies are either first-party (associated with the domain the user is visiting) or third party (associated with a domain that's different from the domain the user is visiting). Google may use first-party cookies when third-party cookies are not available."
Email from Google to Adsense Partners with the text attached below. The section "First-Party Cookie Controls are Changing" is highlighted as well as the text "your first-party cookies will also be shared with Authorized Buyers" Full text of email: Dear Partner, We're making some changes to how first-party cookies are managed in your AdSense account to simplify controls and improve your access to third-party demand. First-Party Cookie Controls Are Changing We've combined the controls for enabling first-party cookies and personalization into one single control. This means that turning on the new control will enable first-party cookies for the publisher, share it with demand sources and enable all usages including personalization. The new control would be set to the existing personalization control to aid the transition. Sharing with Authorized Buyers Currently, the first-party cookies are shared with Google demand sources (Google Ads, Display & Video 360). Starting no earlier than December 12 2024, your first-party cookies will also be shared with Authorized Buyers. However, for the time being, this sharing will not include users in the EEA, Switzerland, UK, California, and some US states. If you're already using first-party cookies for personalization, sharing with Authorized Buyers will be turned on by default. If you're only using first-party cookies without personalization, sharing will remain off. You can find more detailed information about these changes and how AdSense uses first-party identifiers in the Help Center. Sincerely, The Google AdSense Team