Coline C

Is ADINT, Advertising-based Intelligence, the new trend for Computer Network Exploitation (CNE) initial access and commercial surveillance solutions ? ADINT defines the exploitation of online advertising processes to collect, correlate, and operationalize large-scale data for intelligence gathering. By weaponizing the advertisement Real-Time Bidding (RTB) process, this technique turns an omnipresent commercial ecosystem into a dual-use surveillance tool.

While initially leveraged for granular geolocation and real-time geofencing through mobile advertising identifiers and metadata correlation, the stakes of ADINT have escalated significantly. It now also serves as an initial access vector for commercial spyware solutions, reshaping the economics of the commercial surveillance vendor (CSV) market as traditional zero-click vulnerabilities become increasingly scarce and costly.

This presentation provides a comprehensive overview of the current ADINT landscape and operational use cases. It will outline the evolution of ADINT and propose a categorization into three operational tiers: Passive ADINT, characterized by the passive collection and correlation of RTB bidstream data; Active ADINT, which employs on-demand micro-targeting and geofencing for real-time target validation; and Offensive ADINT, where the ad delivery mechanism itself is repurposed as a zero-click intrusion vector for initial access.

Based on documented cases, the presentation will also examine how commercial surveillance vendors weaponize ADINT by exploiting the structural opacity of the AdTech industry. By rebranding intrusive monitoring as legitimate analytics, these firms leverage regulatory arbitrage to circumvent dual-use export controls, highlighting the urgent need for stakeholders to adapt their defensive and policy responses.