# Penlink's Webloc ad-surveillance tool spreads globally

Published: 2026-11-12 · Severity: routine · Sectors: Government (National)
Canonical: https://vorant.io/reports/ccc79ec4-4bae-5922-8fcd-db04bef80ae6/penlink-s-webloc-ad-surveillance-tool-spreads-globally
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> Bloomberg and Citizen Lab research shows government agencies in at least a dozen countries use Penlink's Webloc to mine ad-tech data for mass surveillance.

Source: citizenlab.ca — https://citizenlab.ca/security-agencies-worldwide-found-to-use-ad-based-surveillance-system

## What to check

- Applies to: Whether this concerns you is not assessed; the names the report mentions are listed below.

Citizen Lab highlights a Bloomberg investigation that builds on its own April 2024 research into Penlink's Webloc, an ad-based surveillance system that harvests advertising identifiers and location data to track individuals. Citizen Lab's original report, based on open-source research, FOIA requests, and infrastructure mapping, identified Webloc customers in the US, El Salvador, and Hungary, with Austria's Ministry of the Interior confirmed as a customer afterward. The Bloomberg follow-up expands the known customer list to include the UK, Netherlands, Germany, Mexico, Singapore, Saudi Arabia, UAE, and Israel.

Researcher Wolfie Christl describes Webloc as a mass surveillance capability that is diffusing from military and intelligence agencies down to federal and even local law enforcement. The article raises legal concerns about the use of such ad-tech-derived surveillance in Europe and the UK, and flags heightened risk where it is deployed by authoritarian governments. There is no technical exploitation, malware, or compromise described here — this is a disclosure of a commercial surveillance product's proliferation among state security and law enforcement bodies, relevant to privacy, policy, and civil-liberties risk assessments rather than network defense.

Defenders and organizations with privacy or compliance responsibilities should be aware that ad-tech data broker ecosystems can be leveraged by government customers for location and identity tracking at scale, independent of traditional cyber intrusion techniques. There are no IOCs, CVEs, or detectable TTPs associated with this reporting.

## Mentioned in this report

- Threat actors: Penlink
- Malware: Webloc

Source reporting: https://citizenlab.ca/security-agencies-worldwide-found-to-use-ad-based-surveillance-system

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ccc79ec4-4bae-5922-8fcd-db04bef80ae6/penlink-s-webloc-ad-surveillance-tool-spreads-globally.
In the app the same report carries live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup