OSINT Beacon

Delivery and verification

Nico Dekens — Mon, 26 Oct 2026 00:00:00 GMT

Delivery and verification, from about 6 to 26 October 2026: ad-delivered mercenary spyware, satellite evidence, passive collection tools, and the November conferences.

Editor's note

AdFection is the story I would put in front of a team this week. Citizen Lab’s report says a targeted ad, once it renders, was enough to deliver zero-click mercenary spyware, including Candiru on Al Jazeera devices. The delivery channel is the ad stack. The other half of this issue is verification. Bellingcat’s model test is strong on the first cut of a geolocation and weak where the job ends. I wrote that up under Featured analysis. The November conferences are sorted by date, with a calendar file on each row.

Featured analysis: The model can narrow the map. You still finish the job.

Nico Dekens

Bellingcat has been timing language models on geolocation since June 2025. The October round is the one to read, because the test finally looks like the work.

Each model received 52 photographs that had not been published anywhere online. The frames came from Bellingcat staff and the volunteer community. Metadata was stripped. There were no significant landmarks, and the set included snow, fog, and night. The prompt asked for one coordinate pair, the photographer’s position. No list of guesses, and no confidence score to hide behind. Models could use the provider’s own tools: search, code execution, and page fetch. Output was capped at 64,000 tokens, on the default effort setting, with 15 minutes per photo. One rescue prompt was allowed if the first answer came back without coordinates.

That is a harder test than a Street View game. It is also the right comparison for a live case.

The current models are better at the first move. Bellingcat reports that the strongest of them placed more than half of the 52 photos within 25 kilometres, and that several models put at least 10 of the 52 inside one kilometre. Claude’s Opus and Fable sat at the top of the table on either score. Gemini 4 Argon led the Mean Log Score, the metric built so the last few kilometres count. A GeoGuessr-style score treats 500 metres and 5 kilometres as nearly the same result. On a real job those two answers are different buildings.

The last stretch is where a geolocation is actually made: matching features and checking perspective, often on a bad frame, often against a second source. Bellingcat’s write-up says none of the models was foolproof, and that a model can state a wrong position with confidence. In a military or intelligence setting, that miss carries a different cost than a hobby map. Bellingcat also notes that Anthropic’s public comparison used GeoGuessr and images that were already online, including Street View: daytime, navigable, and absent from large parts of the world. Anthropic’s own caveat, as Bellingcat reports it, is that this does not clearly match the job of pinning a location in near real time in a less populated battlefield. Bellingcat’s set was unpublished on purpose, so a strong score is harder to explain as a photo the model had already seen.

Bellingcat also tried a supercharged agent on Claude Opus: extra instructions, satellite tiles, and a lookup against their OpenStreetMap search. On a photograph at the Global Campus of Human Rights in Venice, 11 of 17 off-the-shelf models landed within 5 kilometres. The customised agent, and GeoSleuth, were the ones that named the camera position. The same write-up says those runs are not a straight comparison with the off-the-shelf table, because the timeout and the toolset were different, and that the boosted models still got locations wrong.

Let the model throw away the wrong continent and the wrong city. Then do the last check yourself, on imagery you can defend, with a method you can explain. If the pin is unverified, it is a suggestion, and a suggestion is where the work starts.

The score table and the method notes are in Bellingcat’s piece, Can LLMs supercharge geolocations?.

News

Pegasus against Serbian pro-democracy figures

19 October 2026 · Citizen Lab · citizenlab.ca · Permalink

Citizen Lab, with the SHARE Foundation, reports with high confidence that Vladan Đokić, rector of the University of Belgrade, was infected in 2026 with NSO Group's Pegasus in a zero-click attack. Prosecutor Rade Bajić received an Apple threat notification on 13 August, which the lab treats as a high-confidence sign of mercenary-spyware targeting. The note brings the public count of Serbian civil-society cases to at least 16.

Why it matters. A university rector and a prosecutor are now in the public record, and the Serbian civil-society count is at least 16.

Exposing AdFection

15 October 2026 · Citizen Lab · citizenlab.ca · Permalink

Citizen Lab reports the first public confirmation of zero-click mercenary spyware delivered when a targeted advertisement renders, a technique it calls AdFection. Discover-Tech placed those ads, and devices at Al Jazeera were infected with spyware from Candiru, rebranded as Integrity Labs. Google and IAB Europe removed Discover-Tech from their advertising vendor lists in early October 2026.

Why it matters. A rendered ad was enough to deliver zero-click spyware, so the advertising stack itself is an exposure path.

Satellite images of tree felling at East Potomac Golf Links

15 October 2026 · Bellingcat · bellingcat.com · Permalink

Bellingcat compares Planet Labs imagery of East Potomac Golf Links in Washington, DC, from 8 and 13 October. The later scene shows large cleared sections after reports that 430 trees were cut down over the weekend of 10 October. That felling prompted an emergency court hearing on 12 October, which barred further changes until later in the month.

Why it matters. The 8 October and 13 October scenes show the cleared ground after the weekend felling.

Tools

MISP modules v3.1.1

25 October 2026 · MISP · misp.github.io · Permalink

misp-modules 3.1.1, released alongside the MISP 3.0 early access, adds 33 expansion modules. New pivots include Team Cymru Scout, Shodan InternetDB, Zetalytics passive DNS, and the Wayback Machine, along with sandbox, malware, and vulnerability lookups. The release also adds firewall ACL exporters and a round of fixes to existing connectors.

Why it matters. Thirty-three new expansion modules are new pivots. The release matters for what those connectors can reach.

OpenOSINT v2.33–v2.36

19 October 2026 · OpenOSINT · github.com · Permalink

Releases from 10 to 19 October, v2.33 through v2.36, make passive collection the default, add a --public-only network guard, and make exposure checks configurable. v2.33 also caps how many tool calls a run may make. v2.36 lets a caller choose which exposure checks to run.

Why it matters. Passive collection is now the default, and a public-only guard limits how far a run can reach.

Trace Labs OSINT VM 2026.10

14 October 2026 · Trace Labs · tracelabs.org · Permalink

The 2026.10 OSINT VM adds a dedicated apt repository and a tlosint-meta package, so most of the toolkit can be installed and updated through apt. The same release adds 18 SOCMINT tools and a Debian QubesOS template with the tools preinstalled. New tools are expected to build for arm64 and amd64, follow vendor terms of service, and be actively maintained.

Why it matters. An apt repository and a Qubes template make the 2026.10 VM easier to install and keep current.

Tradecraft

10 top OSINT data sources and how to use them

22 October 2026 · ShadowDragon · shadowdragon.io · Permalink

A categorized guide to ten OSINT source types, published by ShadowDragon and written by Nico Dekens, covering social media, public records, corporate registries, domain and certificate data, imagery, breach sets, news archives, forums, and dark-web sources. It treats a finding as a lead until a second independent source agrees. Read it as a map of sources; the page is also a vendor resource.

Why it matters. Use it as a map of source types. A finding stays a lead until a second independent source agrees.

Can LLMs supercharge geolocations?

22 October 2026 · Bellingcat · bellingcat.com · Permalink

Bellingcat tested about ten models on 52 photos that had not been published online, and asked each for a single set of coordinates. Newer models narrowed the search much faster, and the strongest placed more than half the photos within 25 kilometres, but none was reliable for an exact point. The testers keep a person in the loop for that last check.

Why it matters. The strongest models placed more than half of 52 unpublished photos within 25 kilometres. None was reliable for an exact point.

Events

Osintomático 2026

4 November 2026 · Osintomático · pretix.eu · Permalink

Osintomático and OsintomátiCOPS run 4–6 November at the Universidad de Alcalá in Alcalá de Henares, near Madrid. 4 November is limited to law enforcement and the armed forces; 5 and 6 November are open to the public. Public tickets for those two days are €35, including VAT.

Why it matters. 4 November is limited to law enforcement and the armed forces. Public tickets for 5 and 6 November are €35.

SANS Amsterdam November 2026

9 November 2026 · SANS · sans.org · Permalink

SANS Amsterdam runs 9–14 November at the Amsterdam Marriott Hotel, in person or live online. The slate includes SEC587, Advanced Open-Source Intelligence (OSINT) Gathering and Analysis, a six-day course starting at 08:30 CET.

Why it matters. SEC587, Advanced Open-Source Intelligence, is on the slate, in person or live online.

Bellingcat Deep Dive, Toronto

16 November 2026 · Bellingcat · bellingcat.com · Permalink

A five-day in-person workshop on open-source investigations, 16–20 November in Toronto, priced at €3,200. Sessions cover geolocation and chronolocation, identifying people across platforms, and using AI in a research workflow. Participants are asked to bring a research question; it is not a tool tutorial for first-time researchers.

Why it matters. A five-day in-person workshop for people who already have a research question, priced at €3,200.

PFIC Fall Summit

19 November 2026 · PFIC · pfic-conference.com · Permalink

PFIC's fall summit is online and free on 19 November, 9:00–13:00 US Eastern. The day is one of the 2026 quarterly virtual summits for digital forensics, OSINT, and cyber work. Enrollment is complimentary, and each summit date is a separate registration.

Why it matters. Online and free, 09:00–13:00 US Eastern, with a separate registration for this summit date.

OSINT Live 2026 recap

20 October 2026 · Skopenow · skopenow.com · Permalink

Skopenow's recap of OSINT Live, held on 15 October, covers sessions on teams of specialized AI agents and on synthetic-identity fraud. The same post announces a public beta of X-Ray, which checks media for signs of AI generation or manipulation using detection, metadata, and content credentials. X-Ray is not yet sold inside the Skopenow platform.

Why it matters. The recap is the public note on X-Ray’s beta. X-Ray is not yet sold inside the Skopenow platform.

Provenance and attribution

Nico Dekens — Tue, 06 Oct 2026 00:00:00 GMT

Provenance and attribution, from about 16 September to 6 October 2026: hidden ownership, influence-for-hire infrastructure, imagery dates, and the October conferences and meetups.

Editor's note

This first briefing is about provenance. Open-source reporting preceded charges over hidden Russian ownership of a forensics tool sold to U.S. agencies. Those are allegations, and both men are presumed innocent. Citizen Lab mapped an influence-for-hire firm from its own infrastructure. A viral view of Gaza that was passed around as new was imagery captured in February 2026. For a basemap, the capture date is the one that counts. The rest of the issue is tools, a definition of what open means, and the October calendar.

News

Oxygen Forensics leaders charged over hidden Russian ownership

24 September 2026 · CyberScoop · cyberscoop.com · Permalink

CyberScoop reports the arrests of Oxygen Forensics CEO Lee Reiber and Russian co-owner Oleg Davydov. A federal complaint charges them with conspiracy to commit wire fraud for concealing Russian ownership, and Russian development, of forensics software sold to U.S. agencies including the Secret Service. The complaint does not allege malicious code. The Justice Department announced the case on 23 September. These are allegations: both are presumed innocent.

Why it matters. The allegation is hidden Russian ownership of forensics software sold to U.S. agencies, not malicious code. Both are presumed innocent.

BlackCore's influence operations for hire

17 September 2026 · Citizen Lab · citizenlab.ca · Permalink

Citizen Lab maps BlackCore, an Israeli influence-for-hire firm, from its own sites, WHOIS, and passive DNS: subdomains, a public demo of coordinated messaging and counter-narratives, and a training course for Angolan government staff. That course included a supervised influence operation. The aliases in the materials match Facebook and Instagram accounts, including some already removed.

Why it matters. The lab’s map runs from the firm’s own sites, WHOIS, and passive DNS to accounts that match the aliases in its materials.

Tools

Flowsint v1.2.13

3 October 2026 · Flowsint · github.com · Permalink

Flowsint is an open-source platform for graph-based investigations. The 3 October release enforces object-level authorization when a flow is read, updated, or deleted. It also stops a node update from clearing fields that were not set, and fixes the Maigret username enricher so display name, bio, location, and created-at are kept.

Why it matters. The 3 October release is an authorization and data-integrity fix, not a new collection source.

Censys CLI Skills

24 September 2026 · Censys · censys.com · Permalink

Nine markdown skills that teach an AI coding assistant to drive cencli, the Censys command-line client for public Internet scan data. Wrappers cover search, view, aggregate, enrich, Censeye, and timeline. A CenQL reference and two methodology files tell the agent to count how common a pivot is before trusting it, and to leave the raw output next to the conclusion. Requires cencli 1.0 or later. The files are plain markdown, so they are not tied to one assistant.

Why it matters. The skills tell an assistant to count how common a pivot is before trusting it, and to keep the raw output next to the conclusion.

Tradecraft

Viral Google Maps images of Gaza were not the newest view

1 October 2026 · Bellingcat · bellingcat.com · Permalink

Posts treated a Google Maps refresh as new satellite imagery of destruction in Gaza, including Rafah. Google told Bellingcat the Airbus scenes had been online since June and were captured in February 2026. Planet Labs imagery from September shows demolitions that continued after that date, in Rafah, Bani Suheila, Shujaiya, and Jabaliya. For dating a basemap, the capture date is the one that counts.

Why it matters. Google told Bellingcat the Airbus scenes had been online since June and were captured in February 2026. The capture date is the one that counts.

Open to whom?

24 September 2026 · Blockint · blockint.nl · Permalink

What makes a source open? Ludo Block argues it is set by whoever controls access, and tested against a generic member of the public, not against the analyst who happens to be asking. Language, expertise, budget, and search-engine indexing are restraints on the observer. Intranets, closed memberships, and protected databases are closed sources. A reply to the claim that OSINT should be abandoned as a concept.

Why it matters. Open is set by who controls access, tested against a member of the public, not against the analyst who already has it.

OSINT techniques: a field catalog for investigators

14 September 2026 · ShadowDragon · shadowdragon.io · Permalink

A categorized guide to OSINT technique, published by ShadowDragon and written by Nico Dekens. It covers social media, geolocation, domain and IP work, public records, advanced search, forums, and video and audio, and it draws the line at hacking and social engineering. Read it as a map of methods. The page is also a vendor resource.

Why it matters. Use it as a map of methods. The page draws the line at hacking and social engineering, and it is also a vendor resource.

Events

OSINT workshop, Den Haag

15 October 2026 · Bibliotheek Den Haag · bibliotheekdenhaag.nl · Permalink

Free workshop on Thursday 15 October, 14:00–17:00, in Lab B on the third floor of the Centrale Bibliotheek in The Hague. Journalists from Het Reizend Huis voor de Journalistiek show how open sources are used to test whether footage is genuine, synthetic, or from a different event. Open to the public, not only to journalists.

Why it matters. A free public workshop on telling genuine footage from synthetic or recycled footage.

M3C 2026

21 October 2026 · M3C · m3c.tech · Permalink

Sixth edition of M3C, in person in Munich on 21 and 22 October, plus an optional Maltego training day on 20 October. Free, with a guest list of about 100. The two days mix panels, investigation walkthroughs, and a hands-on challenge on cybercrime, intelligence analysis, and cross-border work. Venue: Holiday Inn Munich Westpark. Both training tracks were listed as full.

Why it matters. Free and in person in Munich, with a guest list of about 100. Both training tracks were listed as full.

Trace Labs Global OSINT Search Party CTF

28 September 2026 · Trace Labs · tracelabs.org · Permalink

A four-hour online capture-the-flag in which volunteers use OSINT on missing-person cases, run with law enforcement. Trace Labs set it for 24 October, 9:00–13:00 PDT (12:00–16:00 EDT). Tickets went on sale 4 October. The 28 September announcement is linked below.

Why it matters. Four hours online on missing-person cases, run with law enforcement. Tickets went on sale 4 October.

OScon '26

30 October 2026 · OSINT Switzerland · osintswitzerland.ch · Permalink

Second edition of OScon, a one-day conference from OSINT Switzerland. Friday 30 October, 09:00–17:00 at Volkshaus Zürich, then networking. Sessions cover analytical attention, working across Chinese, Russian, and Arabic sources, infostealer logs, a multi-year financial crime, missing persons in Ukraine, the .ch DNS zone, and cross-border propaganda.

Why it matters. One day in Zürich, 09:00–17:00, then networking. The programme runs from analytical attention to the .ch DNS zone.

What Iran and Ukraine reveal about OSINT in war

22 September 2026 · CSIS · csis.org · Permalink

Justin Sherman at CSIS writes that the U.S.–Iran war and Russia’s war on Ukraine show how little a government can control adversary use of commercial geolocation, satellite imagery, social media, and OSINT-plus-AI products. He argues for limiting the sliver that can actually be limited, including data-broker sales and operational security, and for obfuscating the rest.

Why it matters. Sherman’s argument is about the sliver a government can limit: data-broker sales and operational security.

OSINT Beacon

Delivery and verification

Editor's note

Featured analysis: The model can narrow the map. You still finish the job.

News

Tools

Tradecraft

Events

More

Provenance and attribution

Editor's note

News

Tools

Tradecraft

Events

More