Citizen Lab researchers identified a new spyware strain, called AdFection, that can infect phones and computers simply by displaying an ad, without any click required. The tool was built by Israeli firm Discover-Tech and used to target journalists and staff at Al Jazeera, NATO, the European Commission, NVIDIA and Arm, according to the report. Google has since suspended Discover-Tech from its ad platforms after a joint investigation with Citizen Lab and Confiant.
engadget.com
· 2026-10-15
Security researchers say devices at Al Jazeera were infected with Candiru spyware (rebranded 'Integrity Labs') through targeted online ads, a technique they call AdFection. They identify Israeli firm Discover-Tech as the buyer of the malicious ads, running a platform called Controlium that can de-anonymize and infect devices automatically when an ad loads, with analysis of four billion bidding records showing ads served across nearly 200,000 sites and apps.
citizenlab.ca
· 2026-10-15
Researchers at the University of Toronto's Citizen Lab identified a campaign, named 'AdFection,' in which an Israeli-registered ad company allegedly linked to a spyware vendor's servers infected dozens of devices through digital advertising, with no action required from victims. Citizen Lab says this is the first publicly documented technical evidence of spyware being distributed this way.
wired.com
· 2026-10-15
iVerify disclosed a new variant of the DarkSword iPhone exploit chain, dubbed P7 DarkSword, after finding it on the iPhone of a financial-institution employee two months ago. The company says P7 extends compatibility to iOS 18.7, beyond the iOS 18.6 limit of the variant it had previously tracked, and is being spread via malicious ads in watering-hole attacks rather than targeting specific individuals.
9to5mac.com
· 2026-10-08
Paragon Solutions, the spyware maker acquired by US firm AE Industrial Partners in late 2024 and merged with RedLattice, canceled two intelligence contracts with Italy after WhatsApp alleged its Graphite spyware infected over 60 phones across 20-plus countries, including journalists and activists. RedLattice CEO Andrew Boyd told WIRED the company never investigated the abuse allegations or verified them with WhatsApp or Citizen Lab, and instead ended the Italy relationship purely because it was deemed too risky to maintain. Italian authorities have denied any wrongdoing.
wired.com
· 2026-10-01
Google disclosed that a vulnerability in Pixel phones' modem software, tracked as CVE-2026-58704, was exploited in a limited number of targeted attacks before being patched this week. The flaw allowed attackers to escalate privileges from the isolated modem component into the phone's broader system without any user interaction, a so-called zero-click exploit. Google has not identified who carried out the attacks.
techcrunch.com
· 2026-09-16
Security researchers outline how spyware on Android phones can be spotted through symptoms like sudden battery drain, overheating, unexplained data usage, unfamiliar apps, or apps unexpectedly requesting camera and microphone access. Infections most often occur through phishing links or sideloaded apps outside the Play Store, though rogue apps occasionally slip past Google Play Protect too.
engadget.com
· 2026-09-15
Burning Man organizers updated their official survival guide to allow Meta's camera-equipped smart glasses at this year's festival, provided wearers get explicit permission before recording anyone in frame. The policy contrasts with venues like New York nightclub Basement, which has vowed to permanently ban attendees caught wearing the devices.
futurism.com
· 2026-09-02
Apple has warned users of possible mercenary spyware targeting since 2001 via email, iMessage, and account banners. Since September, these threat notifications now also appear directly on a device's Lock Screen and in Settings, making them far more difficult to overlook. The alerts signal potential targeting by commercial surveillance tools from firms like NSO Group, Paragon, or Cytrox, but do not confirm a successful attack or identify the attacker.
accessnow.org
· 2026-08-27
GoKawiil