Exposing the Shadows of Surveillance Capitalism: How DecryptAds Brings Transparency to the Murky AdTech Supply Chain

Main Facts

The digital advertising ecosystem—an expansive, multibillion-dollar machine responsible for funding the modern internet—has long operated behind a veil of opacity. For everyday internet users and cybersecurity researchers alike, identifying who is displaying advertisements, tracking browsing behavior, or harvesting sensitive personal data from mobile applications has traditionally been a frustrating guessing game. While a portion of this data has technically been semi-public, it remained locked away in fragmented silos, accessible primarily to massive advertising platforms and specialized industry insiders.

Enter DecryptAds, a powerful, newly launched, and entirely free intelligence service designed to scrape, correlate, and democratize adtech data. Accessible via decryptads.com, the platform aggregates the public declaration files that websites and mobile applications are required to maintain. By systematically cross-referencing files such as ads.txt, app-ads.txt, buyers.json, and sellers.json, DecryptAds provides a holistic view of the digital tracking and monetization partnerships that define specific domains and apps.

Developed by a team including Zach Edwards—chief research officer for DecryptAds and a threat researcher at the security firm Infoblox—the tool approaches the advertising technology sector from an adversarial security perspective. Rather than serving purely commercial interests, DecryptAds is engineered to unearth systemic privacy and security risks, including supply-chain integrity failures, malicious malvertising operations, state-sponsored ad networks, and the proliferation of AI-generated content farms.

Chronology and Evolution of AdTech Transparency

The transparency files that power DecryptAds were not created overnight; they represent a hard-fought industry standard born out of a desperate need to combat ad fraud.

• The Wild West of Programmatic Advertising: For years, programmatic advertising grew exponentially without standardized verification methods. Bad actors routinely spoofed publisher domains, inserted malicious payloads, and engaged in arbitrage without oversight.
• The Introduction of ads.txt (2017): To combat domain spoofing and unauthorized inventory reselling, the Interactive Advertising Bureau (IAB) introduced ads.txt (Authorized Digital Sellers), a simple text file placed on web servers to list authorized ad sellers. This was later expanded to mobile apps via app-ads.txt and supplemented by sellers.json and buyers.json frameworks.
• The Siloing of Data: Although these files were publicly accessible, viewing them in isolation offered little utility. A single file could be manipulated, cloned, or ignored, leaving security researchers unable to trace the broader web of corporate relationships.
• The Rise of State-Level Data Broker Registrations (2023–2026): Regulatory pressure began to mount as states including California, Oregon, Texas, and Vermont enacted laws mandating that data brokers register their operations if they buy or sell consumer data. This slowly trickled into the public domain.
• The Launch of DecryptAds (August 2026): Recognizing that supply-chain vulnerabilities rarely manifest in a single isolated file, Edwards and his co-founders launched DecryptAds. The platform automates the scraping and correlation of these public disclosures, turning isolated text files into comprehensive, searchable dossiers on corporate tracking practices.

Supporting Data: Unpacking the Digital Supply Chain

To understand the sheer scale of modern digital tracking, one need only look at how prominent digital properties utilize adtech networks. A search on DecryptAds for the major sports network espn.com, for instance, reveals a staggering network of 143 ad partners and 19 registered data broker domains explicitly listed within its ads.txt and app-ads.txt files.

According to DecryptAds’ analytical framework:

• Geolocation Tracking: Nearly half of the data brokers declared by espn.com collect precise geolocation data from visitors who do not utilize ad-blocking technologies.
• Device Fingerprinting: An additional three data partners explicitly disclose the collection of device fingerprints and sensitive personal identifying information.
• High-Risk Geographies: DecryptAds features a dedicated "Geo-Risk" warning system that highlights adtech partners headquartered in adversarial nations or financial hubs closely linked to them, such as Russia, China, Cyprus, and the United Arab Emirates (UAE).

Espn.com, for example, maintains operational ties with four advertising entities based in Russia, China, or the UAE. Among them is Between Digital, an adtech firm that lists a corporate address in New York City. However, DecryptAds exposes Between Digital as a Russian firm whose publisher payout offers are processed through Alfa Bank—Russia’s largest private commercial bank, which was placed under sweeping U.S. financial sanctions following the 2022 invasion of Ukraine. Furthermore, public data shows that Between Digital is integrated into approximately 55,000 partner websites, including prominent U.S. military news portals such as armytimes.com, airforcetimes.com, defensenews.com, navytimes.com, marinecorpstimes.com, and federaltimes.com.

Similar deep-dives reveal complex international entanglements. The Opera web browser—which remains widely used globally despite being majority-owned by the Chinese firm Kunlun Tech since 2016—lists 27 registered data brokers on its domain profile. These include 15 adtech partners in the UAE, six in China, three in Cyprus, two in Russia, and one each in Hong Kong and Ukraine.

Official Responses and Industry Reactions

As of publication, security researchers and independent journalists have reached out to several organizations highlighted in DecryptAds’ initial public audits.

• Between Digital: KrebsOnSecurity sought comment from Between Digital and its founder regarding its ties to sanctioned Russian financial infrastructure and its extensive footprint across U.S. defense-related media outlets. At the time of reporting, neither the firm nor its leadership had issued a formal public response.
• The AdTech Industry Silence: According to Zach Edwards, major programmatic advertising networks have historically operated under a code of quiet exclusion. When an ad network suspects an advertiser of engaging in fraudulent clicks, bot-driven traffic, or malvertising, it will frequently remove the offending entity from its sellers.json file without issuing a public warning or sharing intelligence with industry peers.

"The way the adtech industry works, someone will write a report about ad fraud and only share it with their own clients and they won’t make it public," Edwards explained. "The ban is just removing them from the sellers.json file, but they told nobody. One day it was there, the next it was gone."

To bridge this visibility gap, DecryptAds introduced a Quiet Removals Feed, which aggregates and tracks simultaneous seller deletions across multiple ad exchanges, giving security analysts a clear window into who is being silently blacklisted by the advertising industry.

Broader Implications: Malvertising, AI Slop, and Network-Level Defense

The implications of DecryptAds’ launch extend far beyond corporate privacy concerns, directly touching upon national security, consumer fraud, and malware distribution.

Malvertising and AI-Generated Content Farms

The phenomenon of "malvertising"—the injection of malicious advertisements designed to push zero-click malware, drive credential-harvesting phishing campaigns, or execute drive-by downloads—rarely targets high-traffic, heavily monitored destinations like major news outlets or enterprise portals. Instead, threat actors focus their efforts on low-quality, machine-generated content farms colloquially known as "AI slop."

These websites, populated entirely by automated blog posts and synthetic images covering topics from culinary recipes to automotive repair, rarely invest in third-party brand safety tools. As a result, they act as greased rails for threat actors. Recent investigations by security firm Bitsight revealed that malicious streaming sticks (such as the H96 brand) were secretly programmed to spoof mobile devices and click on ads hosted across networks of low-tier AI slop sites controlled by entities like the Fengwo Group. By pivoting on seller IDs through DecryptAds, researchers were able to link these dormant AI content farms directly to Russian ad infrastructure operated by Yandex.

The Call for Supply Chain Object (SCO) Transparency

Edwards argues that solving the epidemic of malvertising and fraudulent ad injection requires a fundamental shift in how advertising platforms handle data sharing. Specifically, ad networks must begin widely exposing the Supply Chain Object (SCO)—structured metadata attached to bid requests that tracks every seller, reseller, and intermediary involved in an ad impression. Without server-side SCO data, organizations targeted by sophisticated malvertising campaigns remain blind to the exact financial pathways that funded the attacks against their personnel.

Mitigating the Threat: What Users Can Do

Given the pervasive nature of modern ad-tracking and the security risks posed by unverified adtech ecosystems, cybersecurity experts universally recommend a multi-layered defense strategy:

1. Deploy Robust Ad Blockers: Desktop users should leverage open-source, highly efficient browser extensions such as uBlock Origin Lite. Mobile users on Android can utilize compatible browsers running uBlock Origin, while iOS users can turn to Adblock Plus or configure custom blocklists via easylist.to.
2. Implement Network-Level Blocking: For advanced and privacy-conscious users, setting up a dedicated hardware solution—such as running Pi-hole on a low-cost Raspberry Pi connected to a local router—acts as a network-wide DNS sinkhole, stopping tracking and advertisements across all connected household devices, including smart TVs.
3. Exercise Caution with Mobile Apps: Major digital publishers heavily push users toward downloading dedicated mobile apps not because of superior user experience, but because apps facilitate deeper, more invasive tracking, precise geolocation harvesting, and silent data collection used for everything from corporate profiling to AI model training. When possible, interacting with services via a privacy-hardened web browser remains the safer alternative.

As tools like DecryptAds continue to map the subterranean plumbing of surveillance capitalism, the digital rights community gains an unprecedented lens into an industry that has operated in the dark for far too long.