[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fH4c2Kd-vCiEkKDjKTgGjInyomHKqMUnhgJ0ix9SLeBQ":3},{"article":4,"iocs":54,"watch_terms":57,"solutions":58,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"b77d516b-dae3-4008-abeb-50f5fb26259a","‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads","nightmare-scenario-zero-click-spyware-is-infecting-phones-via-targeted-ads-621735","Researchers at The Citizen Lab have for the first time released technical evidence of sophisticated mercenary spyware being distributed via online advertising.","Researchers at The Citizen Lab have uncovered a sophisticated mercenary spyware campaign, dubbed 'AdFection,' that infects devices via targeted online advertisements. This marks the first public technical evidence of zero-click spyware being distributed through the ad ecosystem, merging two significant threats. The campaign targeted devices associated with Al Jazeera, using an Israeli advertising firm linked to spyware developer Candiru.","Mercenary spyware is being distributed via targeted ads, infecting phones with zero-click attacks.","https:\u002F\u002Fwww.wired.com\u002Fstory\u002Fnightmare-scenario-zero-click-spyware-is-infecting-phones-via-targeted-ads\u002F","https:\u002F\u002Fmedia.wired.com\u002Fphotos\u002F6acfe05dd7a1c8d94ba22a02\u002Fmaster\u002Fpass\u002FSecurity_SophisticatedZero-ClickSpywareFoundBeingDistr-ezgif.com-video-to-gif-converter.gif","2026-10-15T10:00:00+00:00","2026-10-15T12:00:21.970277+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"AdFection","product",{"name":21,"type":22},"The Citizen Lab","vendor",{"name":24,"type":22},"Candiru",{"name":26,"type":22},"Discover-Tech",{"name":28,"type":19},"Al Jazeera",{"name":30,"type":22},"Google","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":53},{"id":31,"icon":33,"name":34,"slug":35},[55],{"type":51,"value":18,"context":56},"Name of the spyware campaign",[30,21,24],{"controls":59,"vendors":138},[60,89,111],{"slug":61,"name":62,"problem":63,"products":64},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":35,"name":90,"problem":91,"products":92},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[93,101,106],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":102,"product_name":103,"url":104,"description":105},"dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":107,"product_name":108,"url":109,"description":110},"falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"slug":112,"name":113,"problem":114,"products":115},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":133,"product_name":134,"url":136,"description":137},"dnsfilter","DNSFilter","\u002Fvendor-logos\u002Fdnsfilter.png","https:\u002F\u002Fwww.dnsfilter.com\u002F","DNS filtering for offices and roaming devices.",[],{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":155},"zero-click-spyware-delivered-via-ad-networks-targets-journalists","Zero-Click Spyware Delivered via Ad Networks Targets Journalists","The AdFection campaign reveals how threat actors are weaponizing the digital advertising ecosystem itself as an attack vector, requiring no user interaction to fully compromise a device. By embedding spyware delivery within legitimate-looking ad traffic, attackers exploited trusted third-party supply chains that most organizations never consider part of their threat model. The targeting of journalists at Al Jazeera underscores how mercenary spyware vendors like Candiru enable nation-state-level surveillance capabilities to be purchased and deployed against civil society. This matters because zero-click exploits bypass every traditional user-facing security control, making detection and prevention extraordinarily difficult without deep network and behavioral monitoring. The merger of ad-tech infrastructure with spyware delivery represents a fundamental escalation in the sophistication of commercial surveillance tools.",[144,145,146,147,148,149,150,151,152,153,154],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","CIS Control 15: Service Provider Management","NIST SP 800-161: Supply Chain Risk Management","NIST SP 800-124: Mobile Device Security Guidelines","NIST CSF DE.CM-1: Network Monitoring","NIST CSF ID.SC-2: Supplier Risk Identification","GDPR Article 32: Security of Processing (for EU-based targets)","ITIL: Supplier Management Practice","NSO\u002FPegasus CISA Advisory AA22-181A: Mitigations for Mobile Spyware",{"ITIL: Supplier Management Practice":156,"NIST CSF DE.CM-1: Network Monitoring":157,"CIS Control 15: Service Provider Management":158,"NIST SP 800-161: Supply Chain Risk Management":159,"CIS Control 13: Network Monitoring and Defense":160,"NIST CSF ID.SC-2: Supplier Risk Identification":161,"CIS Control 12: Network Infrastructure Management":162,"CIS Control 7: Continuous Vulnerability Management":163,"NIST SP 800-124: Mobile Device Security Guidelines":164,"GDPR Article 32: Security of Processing (for EU-based targets)":165,"NSO\u002FPegasus CISA Advisory AA22-181A: Mitigations for Mobile Spyware":166},"Supplier management helps track third parties that can introduce risk, such as ad providers.","Network monitoring helps detect unusual traffic from devices targeted by spyware.","Service provider management includes assessing third parties like ad networks that can deliver content to users.","Supply chain risk management helps recognise ad networks as part of the threat model.","Network monitoring helps detect spyware communication from compromised devices.","Identifying supplier risks includes considering ad networks that deliver content to devices.","Network infrastructure management, such as DNS filtering of ad domains, reduces exposure to malicious ad traffic.","Continuous vulnerability management keeps mobile devices and browsers updated, closing the flaws zero-click spyware exploits.","Mobile security guidance helps organisations protect journalists' devices with updates and hardening.","Protecting journalists' devices and data is part of Article 32's appropriate measures where EU data is involved.","Mobile spyware mitigations, such as updates and lockdown modes, help protect high-risk users like journalists."]