Issue 027 min read13 items

Delivery and verification

Delivery and verification, from about 6 to 26 October 2026: ad-delivered mercenary spyware, satellite evidence, passive collection tools, and the November conferences.

Editor’s noteNico Dekens

AdFection is the story I would put in front of a team this week. Citizen Lab’s report says a targeted ad, once it renders, was enough to deliver zero-click mercenary spyware, including Candiru on Al Jazeera devices. The delivery channel is the ad stack. The other half of this issue is verification. Bellingcat’s model test is strong on the first cut of a geolocation and weak where the job ends. I wrote that up under Featured analysis. The November conferences are sorted by date, with a calendar file on each row.

01News

Reporting and public developments from the last two weeks.

  1. Newscitizenlab.ca

    Pegasus against Serbian pro-democracy figures

    Citizen Lab, with the SHARE Foundation, reports with high confidence that Vladan Đokić, rector of the University of Belgrade, was infected in 2026 with NSO Group's Pegasus in a zero-click attack. Prosecutor Rade Bajić received an Apple threat notification on 13 August, which the lab treats as a high-confidence sign of mercenary-spyware targeting. The note brings the public count of Serbian civil-society cases to at least 16.

    Why it matters

    A university rector and a prosecutor are now in the public record, and the Serbian civil-society count is at least 16.

  2. Newscitizenlab.ca

    Exposing AdFection

    Citizen Lab reports the first public confirmation of zero-click mercenary spyware delivered when a targeted advertisement renders, a technique it calls AdFection. Discover-Tech placed those ads, and devices at Al Jazeera were infected with spyware from Candiru, rebranded as Integrity Labs. Google and IAB Europe removed Discover-Tech from their advertising vendor lists in early October 2026.

    Why it matters

    A rendered ad was enough to deliver zero-click spyware, so the advertising stack itself is an exposure path.

  3. Newsbellingcat.com

    Satellite images of tree felling at East Potomac Golf Links

    Bellingcat compares Planet Labs imagery of East Potomac Golf Links in Washington, DC, from 8 and 13 October. The later scene shows large cleared sections after reports that 430 trees were cut down over the weekend of 10 October. That felling prompted an emergency court hearing on 12 October, which barred further changes until later in the month.

    Why it matters

    The 8 October and 13 October scenes show the cleared ground after the weekend felling.

02Tools

Software, data, and utilities that earned a closer look.

  1. Toolsmisp.github.io

    MISP modules v3.1.1

    misp-modules 3.1.1, released alongside the MISP 3.0 early access, adds 33 expansion modules. New pivots include Team Cymru Scout, Shodan InternetDB, Zetalytics passive DNS, and the Wayback Machine, along with sandbox, malware, and vulnerability lookups. The release also adds firewall ACL exporters and a round of fixes to existing connectors.

    Why it matters

    Thirty-three new expansion modules are new pivots. The release matters for what those connectors can reach.

  2. Toolsgithub.com

    OpenOSINT v2.33–v2.36

    Releases from 10 to 19 October, v2.33 through v2.36, make passive collection the default, add a --public-only network guard, and make exposure checks configurable. v2.33 also caps how many tool calls a run may make. v2.36 lets a caller choose which exposure checks to run.

    Why it matters

    Passive collection is now the default, and a public-only guard limits how far a run can reach.

  3. Toolstracelabs.org

    Trace Labs OSINT VM 2026.10

    The 2026.10 OSINT VM adds a dedicated apt repository and a tlosint-meta package, so most of the toolkit can be installed and updated through apt. The same release adds 18 SOCMINT tools and a Debian QubesOS template with the tools preinstalled. New tools are expected to build for arm64 and amd64, follow vendor terms of service, and be actively maintained.

    Why it matters

    An apt repository and a Qubes template make the 2026.10 VM easier to install and keep current.

03Tradecraft

Methods, workflows, and notes on how the work is done.

  1. Tradecraftshadowdragon.io

    10 top OSINT data sources and how to use them

    A categorized guide to ten OSINT source types, published by ShadowDragon and written by Nico Dekens, covering social media, public records, corporate registries, domain and certificate data, imagery, breach sets, news archives, forums, and dark-web sources. It treats a finding as a lead until a second independent source agrees. Read it as a map of sources; the page is also a vendor resource.

    Why it matters

    Use it as a map of source types. A finding stays a lead until a second independent source agrees.

    • From ShadowDragon
    • Introductory
    • Sources
  2. Tradecraftbellingcat.com

    Can LLMs supercharge geolocations?

    Bellingcat tested about ten models on 52 photos that had not been published online, and asked each for a single set of coordinates. Newer models narrowed the search much faster, and the strongest placed more than half the photos within 25 kilometres, but none was reliable for an exact point. The testers keep a person in the loop for that last check.

    Why it matters

    The strongest models placed more than half of 52 unpublished photos within 25 kilometres. None was reliable for an exact point.

04Events

Conferences, training, and meetups, soonest first.

Events sorted by date
DateEventWhereFormatPriceCalendar
4–6 Nov 2026

Osintomático 2026

pretix.euIssue 02

Alcalá de Henares
  • In person
  • LE day
€35Add to calendar
9–14 Nov 2026

SANS Amsterdam November 2026

sans.orgIssue 02

Amsterdam
  • In person
  • Live online
—Add to calendar
16–20 Nov 2026

Bellingcat Deep Dive, Toronto

bellingcat.comIssue 02

Toronto
  • In person
€3,200Add to calendar
19 Nov 2026

PFIC Fall Summit

pfic-conference.com09:00–13:00 ETIssue 02

Online
  • Online
FreeAdd to calendar

05More

Reading and items that still belong in the briefing.

  1. Moreskopenow.com

    OSINT Live 2026 recap

    Skopenow's recap of OSINT Live, held on 15 October, covers sessions on teams of specialized AI agents and on synthetic-identity fraud. The same post announces a public beta of X-Ray, which checks media for signs of AI generation or manipulation using detection, metadata, and content credentials. X-Ray is not yet sold inside the Skopenow platform.

    Why it matters

    The recap is the public note on X-Ray’s beta. X-Ray is not yet sold inside the Skopenow platform.