[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f16al9fMt89ikqc37gSxZSL07E6gh0X8gFgMqyBDWDz0":3},{"article":4,"iocs":54,"watch_terms":60,"solutions":61,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"07ea0ccc-0366-4273-89e7-0f18b3bb4049","AdFection: How mercenary spyware invades victims’ devices through targeted advertising","adfection-how-mercenary-spyware-invades-victims-devices-through-targeted-adverti-2d33d1","Researchers say the attacks have serious implications for the online advertising world, and regulators. The post AdFection: How mercenary spyware invades victims’ devices through targeted advertising appeared first on CyberScoop.","The Citizen Lab has identified a new method called AdFection, where mercenary spyware is delivered through targeted online advertisements without requiring user clicks. The Israeli company Discover-Tech, posing as a legitimate ad firm, facilitates these attacks, directing millions of devices to servers of spyware providers like Candiru. This campaign has targeted organizations such as Al Jazeera and the U.S. Department of Defense, raising significant concerns for regulators and the online advertising industry.","Mercenary spyware is being delivered via targeted ads, infecting devices without user interaction.","https:\u002F\u002Fcyberscoop.com\u002Fadfection-zero-click-spyware-discover-tech\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F10\u002FGettyImages-2280733367.jpg","2026-10-15T10:00:00+00:00","2026-10-15T12:00:13.769994+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"AdFection","product",{"name":21,"type":22},"Discover-Tech","vendor",{"name":24,"type":22},"Candiru",{"name":26,"type":22},"Bindecy",{"name":28,"type":22},"Confiant",{"name":30,"type":22},"Google","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":53},{"id":31,"icon":33,"name":34,"slug":35},[55,58],{"type":46,"value":56,"context":57},"Candiru spyware","Mercenary spyware delivered via targeted advertising",{"type":46,"value":26,"context":59},"Mercenary spyware provider connected to Discover-Tech",[30,21,24],{"controls":62,"vendors":146},[63,92,119],{"slug":64,"name":65,"problem":66,"products":67},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":35,"name":93,"problem":94,"products":95},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[96,103,111],{"vendor_slug":97,"vendor_name":30,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"slug":120,"name":121,"problem":122,"products":123},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[124,132,138],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":133,"product_name":134,"url":136,"description":137},"dnsfilter","DNSFilter","\u002Fvendor-logos\u002Fdnsfilter.png","https:\u002F\u002Fwww.dnsfilter.com\u002F","DNS filtering for offices and roaming devices.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",[],{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":163},"mercenary-spyware-hijacks-ad-networks-to-silently-infect-devices","Mercenary Spyware Hijacks Ad Networks to Silently Infect Devices","AdFection represents a dangerous evolution in spyware delivery, exploiting the trusted infrastructure of online advertising to silently compromise devices without any user interaction. A front company, Discover-Tech, masqueraded as a legitimate ad broker to funnel device traffic toward known spyware operators like Candiru, effectively weaponizing the programmatic advertising supply chain. This matters because it bypasses conventional security awareness training — users cannot protect themselves by avoiding suspicious links or attachments when the attack vector requires zero clicks. High-value targets including journalists and government agencies were exposed, demonstrating that no sector is immune when adversaries exploit trusted third-party ecosystems. The incident underscores a critical blind spot: organizations rarely scrutinize the ad networks their browsers silently contact on every page load.",[152,153,154,155,156,157,158,159,160,161,162],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-161: Supply Chain Risk Management","NIST CSF DE.CM-7: Monitoring for Unauthorized Connections","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 RA-3: Risk Assessment","GDPR Article 32: Security of Processing (for EU-targeted victims)","MITRE ATT&CK T1189: Drive-by Compromise","MITRE ATT&CK T1195: Supply Chain Compromise",{}]