When most people browse the web, they assume that the primary relationship is between their browser and the website they chose to visit. In reality, modern web publishing is layered on top of an intricate and largely opaque programmatic advertising supply chain. Every page view triggers a rapid series of real-time auctions involving ad exchanges, data brokers, supply-side platforms, and analytics trackers.
For anyone studying networks and computer systems, it is clear that every external script or network request injected into a page represents an expanded attack surface. I recently read a piece by Brian Krebs detailing a new platform called DecryptAds, which aims to bring transparency to this tangled ecosystem by scraping and cross-referencing public adtech declarations. Looking at how this tool operates and what it exposes provides a fascinating lesson in how ad tech has turned into an unmonitored security risk.
The Problem with Scattered Ad Files
Over the past few years, the online advertising industry introduced several standardized text and JSON files to combat basic ad fraud. Publishers host an ads.txt file on their root domain to list authorized sellers, mobile applications use app-ads.txt, and ad networks publish sellers.json files to identify who is buying and reselling their inventory.
In theory, these files allow buyers to verify whether an exchange actually has the right to sell impressions on a specific site. In practice, they are decentralized and messy. A single large publisher might declare hundreds of partners. Reading one file in isolation tells you almost nothing about the broader network.
DecryptAds, developed by threat researcher Zach Edwards and his team, bridges this gap by continuously indexing these files, cross-referencing broken declarations, and combining them with state-level data broker registries. When you combine these datasets, you can trace an entire supply path and see which entities are allowed to execute code, serve assets, or harvest telemetry from a given site.
Geopolitical Risk and Malvertising Vectors
What makes this cross-referencing so valuable from a security perspective is the insight it gives into data flows and geo-risk. For example, DecryptAds flagged that major sports sites and several defense-focused news outlets list adtech partners with infrastructure linked to Russia, China, or financial entities under international sanctions. A company might list a business address in New York, but its actual backend settlements and operations route through sanctioned financial institutions abroad. When these platforms serve scripts on websites visited by sensitive personnel, it stops being a mere privacy issue and becomes a national security concern.
Another major threat highlighted in the report is malvertising. Attackers frequently exploit the ad bidding pipeline to distribute zero-click exploits, drive-by downloads, or malicious redirects. High-traffic mainstream websites often pay for third-party security verification tools to filter out toxic ads before they load. However, the web is currently being flooded with low-quality, AI-generated content farms. These sites exist solely to capture search traffic and monetize it with bottom-tier ad networks.
Because these automated content farms do not invest in ad verification, they serve as open channels for malicious campaigns. If a user lands on one of these pages from a search query, malicious actors can target their browser through unchecked ad slots.
The industry also suffers from a lack of transparency regarding enforcement. When an ad exchange discovers fraud or malicious activity from a partner, it rarely publishes a public post-mortem. Instead, it quietly removes the offender from its sellers.json file. This practice lets malicious or shady entities move on to other exchanges without public scrutiny. Tracking these quiet removals across multiple exchanges in real time exposes suspicious patterns that would otherwise stay hidden.
The Missing Piece: The Supply Chain Object
One technical detail in the article that stood out to me involves the Supply Chain Object, or SCO. In standard OpenRTB bidding protocols, the SCO is a piece of structured data passed with bid requests that records every intermediary, reseller, and final buyer involved in handling an impression.
Right now, this information is handled server-side and kept proprietary within major ad networks. When an endpoint gets hit with a malicious payload through an ad, incident responders can usually see the malicious redirection in network traffic, but they cannot see the full SCO. Without that server-side supply chain data, it is nearly impossible to pinpoint the exact entity that bought the impression and pushed the exploit. Pushing for broader transparency around SCO data would be a huge step forward for web security research.
Practical Steps for Network Defense
Looking at the sheer volume of trackers and data brokers declared across everyday websites reinforces why aggressive blocking is a baseline requirement for cybersecurity.
From a practical standpoint, browser-based content blockers like uBlock Origin or uBlock Origin Lite remain essential on desktop setups. For broader coverage, implementing DNS-level filtering on your local network using a Raspberry Pi running Pi-hole or using dedicated privacy-focused DNS resolvers is one of the most effective ways to drop tracking queries before they ever leave your local subnet.
It is also a good reminder to treat mobile apps with caution. Mobile applications frequently bypass standard browser isolation and privacy controls, giving embedded ad SDKs direct access to device telemetry, location data, and network details. Whenever possible, using a well-configured browser is safer than installing dedicated apps for every service you interact with.
Source: https://krebsonsecurity.com/2026/08/whos-tracking-you-use-this-new-service-to-find-out/