The Ad-Tech Pipeline Delivered Zero-Click Mercenary Spyware

Citizen Lab traced the first publicly confirmed in-the-wild delivery of zero-click mercenary spyware through targeted advertising, linking infections at Al Jazeera to Candiru and Discover-Tech. A BeyondTrust Remote Support zero-day and newly public mechanics for the Ivanti VPN chain keep edge appliances at the top of the response queue.

Threat Activity & Espionage

Targeted ads infected Al Jazeera devices with Candiru spyware without a click. Citizen Lab’s AdFection investigation calls this the first public technical confirmation of an in-the-wild zero-click mercenary-spyware attack delivered through advertising. It says Discover-Tech’s Controlium platform fingerprinted and de-anonymized devices, then let partners trigger infection when an ad rendered. Analysis of four billion bid records over four months found its ads on almost 200,000 unique sites and mobile apps in dozens of countries. Millions of devices contacted Candiru infrastructure, which researchers characterize as likely tracking and reconnaissance rather than evidence of mass infection. The Citizen Lab report includes the recovered sample and technical indicators. (discussion)
A Kazakhstan-nexus cluster used four delivery chains against government and energy targets across nine CIS countries. Activity tracked as UAT-6275/TAG-193, with assessed overlap with Silent Lynx/YoroTrooper, ran from June 2025 through August 2026. Chains used macro documents, PS2EXE-packaged PowerShell, GitHub-hosted scripts and crafted WinRAR archives exploiting CVE-2025-8088, ultimately deploying FoalShell, Chvost, Laplas or PickleShell. Researchers found no direct indicator or tool overlap proving UAT-6275 and YoroTrooper are identical; the umbrella attribution remains an assessment. The Hacker News has the analysis, and Cisco published campaign indicators.
Compromised D-Link and Ubiquiti devices are being resold as residential proxy capacity. The proxyjacking campaign spans devices in 34 countries, turning victim connections into egress for a commercial proxy network and helping downstream abuse blend into residential traffic. GreyNoise details the infrastructure and detection opportunities.

Vulnerabilities & Exploits

Suspected PRC-nexus actor ARMORY CASTLE exploited BeyondTrust CVE-2026-102764 as a zero-day in late August. ARMORY CASTLE, formerly tracked as UNC5221, used the critical unauthenticated file-upload flaw against BeyondTrust Remote Support appliances; successful exploitation can lead to host-level control. Google Threat Intelligence Group ties the observed exploitation to the actor.
The Ivanti zero-day chain now has public mechanics and a reported independent reproduction. Horizon3.ai says CVE-2026-104935 stems from Ivanti Connect Secure checking one URL for authentication but letting an attacker-controlled header select the CGI script that executes. Attackers chain that mismatch with a temporary file-write path to run code as cgi-server; observed intrusions added a separate privilege-escalation flaw for root. CISA warns that Ivanti’s Integrity Checker may miss memory-only command execution, and Doonsec reports reproducing the unauthenticated RCE and privilege-escalation chain. This adds exploit detail to the initial disclosure (earlier coverage).
A Nintendo Switch DHCP stack overflow permits control-flow hijacking from wireless range. The public CVE-2026-82079 disclosure shows crafted DHCP frames overflowing the ldn server and overwriting return addresses; the affected environment lacks ASLR, facilitating arbitrary code execution. The technical report is available through HackerOne.

New Tools & Releases

Fox-IT released a large Cobalt Strike Beacon research corpus. It contains 56,843 raw Cobalt Strike Beacon payloads with parsed configurations and roughly 190,000 sightings, all collected by Fox-IT rather than imported from VirusTotal or other repositories. The packed distribution stays inert until deliberately unpacked, but the resulting Beacons remain live malware stagers and may contain working C2 addresses. The corpus should support configuration-parser testing, clustering and detection engineering; see the Fox-IT release note and Hugging Face dataset.
redStackPRO turns attack infrastructure and defensive AD ranges into exportable Terraform and Ansible. The prerelease topology canvas can build split-horizon Sliver and Mythic infrastructure or target ranges such as GOAD, with cloud credentials remaining on the operator’s machine. AWS and GCP are tested end to end. One caveat: its Guacamole portal currently shares a lab password, with per-operator isolation instead coming from generated WireGuard or OpenVPN credentials. The project is on GitHub.
Summit combines web proxying, scanning and fuzzing in one scriptable CLI. The open-source platform also includes reconnaissance, WAF analysis and CI-oriented workflows, available from Pennacle Security.

AI & Agent Security

HTTP response headers are an indirect-prompt-injection surface, but observed malicious attempts remain sparse. Researchers examined 217.1 million responses—10% of Common Crawl’s September 2026 crawl of 2.17 billion pages—and found 7,959 sites sending AI-directed headers. Of those, 7,271 pointed agents toward another resource such as llms.txt or an MCP server; only 30 sites contained injection attempts, most apparently pranks. Claude Opus, Claude Sonnet and Claude Haiku in Claude Code noticed test headers but did not act by default. They complied in 7 of 9 runs when the user prompt explicitly authorized following the site’s directions, showing why fetch tools should treat headers and their destinations as untrusted inputs. Signals Corps published the study. (discussion)
JPCERT/CC confirmed attackers were using AI for known-vulnerability scanning and API attacks. Investigators found multiple attack servers targeting services both inside and outside Japan. Artifacts showed attackers unpacking Android applications, reverse-engineering Flutter apps with Blutter and Android code with jadx, extracting backend API details and testing them for issues including SSRF. JPCERT/CC does not identify the model or threat actor involved.
Langflow’s authenticated RCE is drawing active exploit attempts. Previdian recorded 1,423 attempts against a honeypot targeting CVE-2026-105740, a CVSS 9.9 flaw in the Langflow platform for AI applications and agentic workflows. That is evidence of active targeting, not 1,423 confirmed compromises. The Hacker News has the report.

Cloud, CI/CD & Supply Chain

GhostAction’s latest wave targeted more than 30,000 repositories after roughly 1,900 GitHub accounts were compromised. On October 8 and 9, the campaign reached repositories across 3,000 users and organizations and attempted to extract 3,174 secrets from public repositories’ CI environments. Hijacked maintainer accounts push deceptively named GitHub Actions workflows that scan current files and Git history for cloud, package-registry and AI-provider keys. Further waves appeared on October 10 and 12, materially expanding the campaign described previously (earlier coverage). The Hacker News summarizes GitGuardian’s findings.
Zeabur broadened its breach disclosure beyond deprecated shared database clusters. The cloud platform says an attacker also accessed some dedicated Google Cloud servers and obtained read access to its platform database. Exposed material included service environment variables, account information and user data; the company says it has blocked the attack vector. The evolving scope is documented in Zeabur’s status notice.

✎ This issue was written by gpt-5.6-sol. No human edited it before publishing — how this works .