Our investigation uncovers two sophisticated telecom surveillance campaigns and, for the first time, links real-world attack traffic to mobile operator signalling infrastructure. The findings expose h...

This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Candiru’s spyware. We also uncover Discover-Tech, and show how the company helps mercenary surveill…

Targeting analysis of the discover-tech ad-intelligence campaign: countries, institutions, domains and ISPs.

Selon le Citizen Lab, des appareils auraient été infectés par un logiciel espion au simple affichage d’une annonce ciblée. Sans click, sans action utilisateur.

There have been allegations of spyware targeting two prominent Serbian figures, raising new concerns about digital surveillance in advance of the country's parliamentary elections scheduled for October 25, 2026. As part of a partnership with Serbia's SHARE Foundation, Citizen Lab researchers confirmed that Vladan Đokić, rector of the University of Belgrade, had his iPhone compromised by Pegasus spyware earlier this year.  A former prosecutor, Rade Baji, was identified as a potential target by the investigation. According to Reuters, Apple notified Baji on August 13 that his phone had been infiltrated with spyware targeting mercenaries. The forensic investigators, however, have not yet determined whether his device was successfully compromised or identified the method used in the suspected attack.  Pegasus is a highly sophisticated spyware program developed by the Israeli surveillance technology company NSO Group that can be used to obtain extensive access to a targeted computer system. Depending on the circumstances of an infection, such access can expose private communications and other sensitive information stored on the phone Đokić has drawn attention for its support of Serbian student-led protest movement, which has organized anti-corruption demonstrations against the government since November 2024.  The positions he holds have also brought him into conflict with the authorities According to Citizen Lab, Serbian authorities raided his offices in March and seized computers and servers as a result of tensions surrounding the student protests. The former prosecutor was involved in proceedings against senior government officials alleged to have engaged in irregularities in connection with a proposed redevelopment project at the protected historic military site in Belgrade.  The development was planned by a company affiliated with Jared Infected devices are known as zero-click exploits. They are a method of compromise that does not require a user to click a link, open an attachment, or take any other action. As of yet, researchers have not publicly identified those responsible for the attack, and the investigation continues. There is less conclusive evidence regarding Baji's case despite Apple's August threat notification indicating mercenary spyware might have been used to target him, but investigators have not determined whether he successfully received the malware. Despite Apple's confirmation that threat alerts were sent to users on August 13, the company has not commented specifically on the two incidents reported. These incidents have renewed concern about the use of commercial surveillance tools by public institutions against their employees.  According to the SHARE Foundation, targeting university officials and judges could result in weakened institutional independence, restrictions on freedom of expression and discouraged investigations into public interest matters. In addition, the organization highlighted the broader pattern of surveillance allegations in Serbia.  There have been reports of at least 14 students, activists, and opposition figures having been targeted with spyware in September. A student activist, Jelena Kontić, filed a criminal complaint on October 6 with Serbia's Prosecutor's Office for High-Tech Crime regarding the alleged installation of Pegasus on her cellphone. Attempts to identify the individuals or organizations behind the latest suspected attacks have not been successful.  Both the Serbian Interior Ministry and NSO Group have not responded to requests for comment. According to the company's previous statements, its technology is marketed to government agencies and commercial relationships involving serious misuse may be terminated. According to the US government, NSO Group was placed on its trade blacklist in 2021 after allegations of human rights abuse involving its surveillance technology were raised.  In preparation for the upcoming parliamentary election on October 25, the latest findings have intensified the scrutiny of spyware used against individuals associated with Serbia's protest movement. Furthermore, these cases raise questions regarding the safeguards surrounding powerful surveillance tools and whether independent researchers are able to identify responsible individuals when such technology appears to be employed against civil society representatives.  A number of recent attacks have raised concern about commercial spyware targeting civil society and public institutions. As Serbia prepares for parliamentary elections, these findings raise further questions regarding surveillance practices, accountability, and safeguards to prevent cyberespionage tools from being misused.

This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Ca...

Citizen Lab Exposes a New Ad-Based Attack The Citizen Lab at the University of Toronto has published a report on a new way to deliver commercial spyware through targeted advertising. Researchers named the technique AdFection. Attackers use the ad bidding system to pick out specific devices. Then they load malicious code the moment an ad appears. The victim never clicks an ad or downloads a file.

Citizen Lab linked Candiru spyware infections at Al Jazeera to targeted ads that triggered attacks without clicks or user action.

Fixed

(post deleted by author)

This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with…

A new type of spyware dubbed "AdFection" is infecting phones and computers via global online advertising networks.

The last sentence is unfinished.