Threat Intel
DecryptAds: New Service Maps Adtech Ecosystem for Security Teams
DecryptAds scrapes ads.txt, app‑ads.txt, buyers.json, and sellers.json from sites and apps to build a comprehensive view of who can serve ads or collect data. Security teams can use the data to spot malicious ad networks, adversarial actors, and supply‑chain gaps. The service is free and designed for privacy‑focused threat hunting.
What Happened
DecryptAds, a free service launched by Infoblox researchers, began scraping the publicly available ad‑tech declaration files that every website and mobile app publishes.
Impact
The tool aggregates ads.txt, app‑ads.txt, buyers.json and sellers.json to create a single, cross‑referenced map of every entity that can serve ads or harvest data on a domain. Security teams can now spot anomalies such as duplicate declarations across unrelated sites, missing sellers, or networks based in hostile jurisdictions.
What to Do
1. Pull the latest DecryptAds snapshot for the domains you manage.
2. Compare the list of authorized sellers against your internal whitelist.
3. Flag any new or unexpected entities, especially those with a history of malicious ads or located in adversarial countries.
4. Use the cross‑reference data to identify supply‑chain gaps—broken links between ads.txt, app‑ads.txt, and sellers.json that may indicate tampering.
How to Use
DecryptAds offers a simple API and downloadable CSVs. Integrate the data into your SIEM or threat‑intel platform to trigger alerts when a new seller appears or when a known malicious network is added to a site’s declaration files.
Related articles
Dorothy Enables Okta Visibility Testing for SecOps Teams
Security teams can now validate their Okta SSO monitoring with Dorothy, a free open‑source tool that simulates attacker actions and maps them to MITRE ATT&CK tactics. By running Dorothy tests and leveraging Elastic Security’s detection rules, defenders can confirm that logs, alerts, and response playbooks cover the most common IAM attack vectors.
Read briefing
Automakers Share PII from Connected Cars with Advertisers and Data Brokers
A study shows that 19 of 21 major automakers routinely transmit personally identifiable data from connected vehicles to advertising and data‑broker networks. The data includes names, email addresses, VINs, and precise geolocations, and is shared with tech giants such as Google, Amazon, and Meta. Defenders should audit app integrations, enforce data‑minimization, and monitor outbound telemetry for compliance.
Read briefing
Huntress Dark‑Web Insight: Threat Actor Marketing & BreachForums Analysis
Huntress researchers John Hammond and Dave Kleinatland presented a deep dive into the dark‑web ecosystem, revealing how threat actors market services and the role of BreachForums in cybercrime. The briefing outlines key tactics, potential impact on organizations, and actionable defenses for SecOps teams.
Read briefing
Elastic Security Labs Releases LLM Safety Assessment Report
Elastic Security Labs has published a new LLM safety assessment report that outlines practical threats to large language models and offers guidance for defenders. The report focuses on data mapping, normalization, and detection strategy for AI‑driven threats. SecOps teams should review the findings and start implementing the recommended detection steps.
Read briefing