Issue 02
OSINT Beacon #2 — 26 October 2026
Delivery and verification, from about 6 to 26 October 2026: ad-delivered mercenary spyware, satellite evidence, passive collection tools, and the November conferences.
Every two weeks, OSINT Beacon picks the open-source intelligence work most worth your time: investigations, tools, tradecraft, and the events where practitioners meet.
This issue is about delivery and verification. Citizen Lab documents targeted ads used to deliver zero-click mercenary spyware, including Candiru infections on Al Jazeera devices, and Pegasus use against Serbian pro-democracy figures. Bellingcat uses satellite imagery to show the extent of tree felling at a Washington golf course, and tests whether language models can geolocate unpublished photos. We also cover three tool releases and the November conferences.
01News
Reporting and public developments from the last two weeks.
Pegasus against Serbian pro-democracy figures
Citizen Lab, with the SHARE Foundation, reports with high confidence that Vladan Đokić, rector of the University of Belgrade, was infected in 2026 with NSO Group's Pegasus in a zero-click attack. Prosecutor Rade Bajić received an Apple threat notification on 13 August, which the lab treats as a high-confidence sign of mercenary-spyware targeting. The note brings the public count of Serbian civil-society cases to at least 16.
Exposing AdFection
Citizen Lab reports the first public confirmation of zero-click mercenary spyware delivered when a targeted advertisement renders, a technique it calls AdFection. Discover-Tech placed those ads, and devices at Al Jazeera were infected with spyware from Candiru, rebranded as Integrity Labs. Google and IAB Europe removed Discover-Tech from their advertising vendor lists in early October 2026.
Satellite images of tree felling at East Potomac Golf Links
Bellingcat compares Planet Labs imagery of East Potomac Golf Links in Washington, DC, from 8 and 13 October. The later scene shows large cleared sections after reports that 430 trees were cut down over the weekend of 10 October. That felling prompted an emergency court hearing on 12 October, which barred further changes until later in the month.
02Tools
Software, data, and utilities that earned a closer look.
MISP modules v3.1.1
misp-modules 3.1.1, released alongside the MISP 3.0 early access, adds 33 expansion modules. New pivots include Team Cymru Scout, Shodan InternetDB, Zetalytics passive DNS, and the Wayback Machine, along with sandbox, malware, and vulnerability lookups. The release also adds firewall ACL exporters and a round of fixes to existing connectors.
OpenOSINT v2.33–v2.36
Releases from 10 to 19 October, v2.33 through v2.36, make passive collection the default, add a --public-only network guard, and make exposure checks configurable. v2.33 also caps how many tool calls a run may make. v2.36 lets a caller choose which exposure checks to run.
Trace Labs OSINT VM 2026.10
The 2026.10 OSINT VM adds a dedicated apt repository and a tlosint-meta package, so most of the toolkit can be installed and updated through apt. The same release adds 18 SOCMINT tools and a Debian QubesOS template with the tools preinstalled. New tools are expected to build for arm64 and amd64, follow vendor terms of service, and be actively maintained.
03Tradecraft
Methods, workflows, and notes on how the work is done.
10 top OSINT data sources and how to use them
A categorized guide to ten OSINT source types, published by ShadowDragon and written by Nico Dekens, covering social media, public records, corporate registries, domain and certificate data, imagery, breach sets, news archives, forums, and dark-web sources. It treats a finding as a lead until a second independent source agrees. Read it as a map of sources; the page is also a vendor resource.
Can LLMs supercharge geolocations?
Bellingcat tested about ten models on 52 photos that had not been published online, and asked each for a single set of coordinates. Newer models narrowed the search much faster, and the strongest placed more than half the photos within 25 kilometres, but none was reliable for an exact point. The testers keep a person in the loop for that last check.
04Conferences
Talks, training, and multi-day gatherings.
PFIC Fall Summit
PFIC's fall summit is online and free on 19 November, 9:00–13:00 US Eastern. The day is one of the 2026 quarterly virtual summits for digital forensics, OSINT, and cyber work. Enrollment is complimentary, and each summit date is a separate registration.
19 November 2026 · Online
Bellingcat Deep Dive, Toronto
A five-day in-person workshop on open-source investigations, 16–20 November in Toronto, priced at €3,200. Sessions cover geolocation and chronolocation, identifying people across platforms, and using AI in a research workflow. Participants are asked to bring a research question; it is not a tool tutorial for first-time researchers.
16–20 November 2026 · Toronto
SANS Amsterdam November 2026
SANS Amsterdam runs 9–14 November at the Amsterdam Marriott Hotel, in person or live online. The slate includes SEC587, Advanced Open-Source Intelligence (OSINT) Gathering and Analysis, a six-day course starting at 08:30 CET.
9–14 November 2026 · Amsterdam
Osintomático 2026
Osintomático and OsintomátiCOPS run 4–6 November at the Universidad de Alcalá in Alcalá de Henares, near Madrid. 4 November is limited to law enforcement and the armed forces; 5 and 6 November are open to the public. Public tickets for those two days are €35, including VAT.
4–6 November 2026 · Alcalá de Henares
05More
Reading, datasets, and items that belong in the issue anyway.
OSINT Live 2026 recap
Skopenow's recap of OSINT Live, held on 15 October, covers sessions on teams of specialized AI agents and on synthetic-identity fraud. The same post announces a public beta of X-Ray, which checks media for signs of AI generation or manipulation using detection, metadata, and content credentials. X-Ray is not yet sold inside the Skopenow platform.