How This Briefing Works
This report opens with key findings, then maps the gaps between what Verisoul discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Verisoul was observed loading and executing before user consent was obtained on 100% of sites where it was detected.
Claims vs. Observed Behavior
pending
“Requires claims extraction via CDT”
Defeat device, session recording, consent bypass, fingerprinting, and persistence detected in runtime
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Verisoul
- →Audit defeat device deployment within fraud detection infrastructure
- →Review session recording retention for authentication workflows
- →Verify fingerprinting scope does not exceed fraud prevention requirements
- →Require consent collection before Verisoul surveillance initialization
If You're Evaluating Verisoul
- →Fraud detection solutions without embedded visitor surveillance
- →Privacy-respecting authentication platforms limiting fingerprinting scope
- →Self-hosted security workflows eliminating cross-customer intelligence leakage
Negotiation Leverage
- →Challenge defeat device mechanisms within security infrastructure
- →Require disclosure of all surveillance capabilities beyond fraud detection
- →Demand opt-out from cross-customer fraud pattern analysis
- →Request data processing agreement amendments addressing visitor tracking through security layer
- →Negotiate liability indemnification for consent violations by fraud detection platform
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Impact: Detection evasion mechanisms obscure surveillance deployment within fraud detection infrastructure.
Full session replay
Impact: Authentication sessions captured in full fidelity, exposing how visitors navigate security challenges and revealing fraud detection trigger patterns.
Ignoring CMP signals
Impact: Tracking mechanisms active within security layer before visitor consent collection completes.
Device identification
Impact: Comprehensive device characteristics harvested for fraud detection persistence across sessions.
Long-lived identifiers
Impact: Long-lived tracking identifiers maintain fraud detection continuity beyond reasonable authentication timeframes.
IOC Manifest
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
21 detection signatures across scripts, domains, cookies, and network endpoints