Citizen Lab says governments are abusing online ads to hack people with ‘zero-click’ spyware

techcrunch.com Oct 15, 2026

Citizen Lab says governments are abusing online ads to hack people with ‘zero-click’ spyware

Curated by Shubham · TechCapsules · Oct 15, 2026

AI-summarised brief · reviewed before publication

Citizen Lab researchers revealed that Israeli advertising firm Discover‑Tech is being used by government‑backed spyware developers to deliver zero‑click malware through online ads. The study documents that spyware makers Candiru and Bindecy exploited Discover‑Tech’s platform to target devices worldwide, including at least 45 Windows computers at Al Jazeera. The attacks, occurring in 2024‑25, leveraged malicious ad code that infected devices without user interaction. The report provides the first technical evidence of state‑backed spyware being distributed via ad networks, exposing a broad range of potential targets.

💡 Why It Matters

· The discovery exposes a new vector for covert surveillance, turning ubiquitous advertising into a weapon that can silently compromise high‑profile devices.
· This escalation forces a reevaluation of ad‑network security and the effectiveness of current defensive measures.

Capsules Cybersecurity

Read full article on techcrunch.com

Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted…

Citizen Lab confirmed that Israeli spyware vendor Candiru infected Al Jazeera devices via zero‑click online ads served by Discover‑Tech. The ads, which loaded silently, sent device identifiers to a Discover‑Tech server that, if the device matched a target, returned malicious code to the browser or app. At least 45 Al Jazeera devices were compromised in 2024‑25, with evidence linking the attack to Candiru. Google, IAB Europe, and other ad platforms removed Discover‑Tech after the findings.

💡 The case shows that state‑backed spyware can reach high‑profile targets through ordinary ad networks, bypassing traditional security checks. It exposes a loophole that lets malicious actors embed malware in seemingly benign advertising, raising urgent questions about ad‑tech vetting and the protection of journalists.

thehackernews.com · Oct 15

AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete…

Singapore-based Ahsay Backup released security updates for AhsayCBS after two vulnerabilities, CVE‑2026‑105133 and CVE‑2026‑105134, were exploited to drop web shells and XMRig miners. The flaws allowed attackers to bypass authentication and execute arbitrary commands. Initial patches in August 2026 were incomplete; the company now offers hotfixes in versions 9.15.2.59 and 10.3.4.45. Huntress confirmed the new fix blocks the attack chain, and CISA added the flaws to its Known Exploited Vulnerabilities list, mandating federal patching by October 17, 2026.

💡 The vulnerabilities enabled attackers to gain unauthenticated remote code execution, compromising sensitive data and enabling cryptocurrency mining. Prompt patching is essential to protect federal systems and prevent further exploitation.

thehackernews.com · Oct 14

Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages

Microsoft, Health‑ISAC, JC3, and a coalition of private firms dismantled three phishing kits—CoGUI, Haozi, and Iron Man System—responsible for over one billion scam emails and SMS messages since January 2026. The kits, linked to the YAM Store marketplace, targeted more than 75,000 organizations across 150 countries, exploiting compromised Microsoft and Google cloud environments. The operation, authorized by court order, exposed shared code and infrastructure among the kits, revealing a coordinated Chinese‑speaking cybercriminal ecosystem.

💡 The takedown halts a massive, globally‑scaled phishing infrastructure that siphoned millions of dollars, underscoring the effectiveness of cross‑sector collaboration in neutralizing sophisticated cybercrime networks.

thehackernews.com · Oct 14

Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App

Attackers exploited a command‑injection flaw in Collabora Online’s Built‑in CODE Server app for Nextcloud, allowing unauthenticated web shell deployment when the local document server was offline. The vulnerability, reported on GitHub on September 10, enabled attackers to execute arbitrary commands as the web‑server user. Collabora released a patch in version 26.4.303 on September 11, later issuing CVE‑2026‑110447 on October 14. The fix requires Nextcloud 30+; older installations must upgrade or remove the app. The flaw affected only the built‑in app, not standalone Collabora servers.

💡 The incident exposes how optional add‑ons can become critical attack vectors, underscoring the need for timely updates in open‑source ecosystems. It also highlights that disabling an app is insufficient; proper version control and removal are essential to safeguard server integrity.

blogs.microsoft.com · Oct 14

Unpaid toll? Missed delivery? Microsoft moves to disrupt a global cybercrime marketplace

Microsoft and Japan’s National Police Agency uncovered a sprawling Chinese‑language cybercrime marketplace that sells stolen accounts, hosting services, and phishing tools. The investigation, expanded with partners such as JC3, Cloudflare, and Oracle, traced the marketplace’s three core components—YAM Store, CoGUI, and Iron Man—to over one billion malicious messages sent to more than 75,000 organizations worldwide, including 750 million targeting Microsoft customers. The operation generated tens of millions of dollars and exploited compromised domains to create fraudulent Microsoft 365 accounts for resale.

💡 The takedown exposes how cybercriminals monetize mass phishing at scale, revealing a sophisticated supply chain that threatens global digital infrastructure. By dismantling key marketplace nodes, Microsoft and partners reduce the tools available for large‑scale credential theft and protect millions of users from future attacks.

thehackernews.com · Oct 14

CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit…

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that the Ivanti Connect Secure (ICS) authentication bypass flaw (CVE‑2026‑104935, CVSS 8.6) is actively exploited, allowing remote attackers to run arbitrary commands on affected versions (25.1.1.1 and earlier, 25.1.2.2 and earlier, 22.8R2.4 and earlier). CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by October 16, 2026. Previdian’s honeypots logged 105 exploitation attempts from Singapore and the U.S., while Volexity documented credential theft and log tampering by the criminal actor UTA0576.

💡 The breach demonstrates that even widely deployed VPN solutions remain prime targets for coordinated, stealthy attacks that can bypass authentication and harvest credentials. The rapid escalation from testing to full exploitation underscores the urgency for organizations to patch immediately and conduct forensic investigations.