[spyware]

6 editions · 8 items

October 20, 2026

Zero Breach is a local, read-only scanner for indicators associated with the AdFection/Candiru ad-delivered spyware campaign. It provides a focused triage option following the zero-click delivery research covered previously, though an absence of known indicators cannot establish that a device is clean. Zero Breach (earlier coverage) · New Tools & Releases
GhostAction has added reverse-proxy phishing and OAuth device authorization to its GitHub workflow attacks. A fake security alert harvested passwords and 2FA codes, then used JavaScript to authorize an OAuth flow with repo, workflow, and read:org permissions. The report also ties a credential stealer disguised as a font to 94 repositories, showing the operator adapting after GitHub disrupted its malicious Actions workflows. The Hacker News (earlier coverage) · Supply Chain, Cloud & Identity
Citizen Lab confirmed with high confidence that Pegasus infected the iPhone of University of Belgrade rector Vladan Đokić. The infection occurred sometime in 2026 through a zero-click exploit, amid broader commercial-spyware targeting of Serbian students, journalists, opposition figures, and civil-society members. Citizen Lab · Threat Activity

October 16, 2026

Targeted ads infected Al Jazeera devices with Candiru spyware without a click. Citizen Lab’s AdFection investigation calls this the first public technical confirmation of an in-the-wild zero-click mercenary-spyware attack delivered through advertising. It says Discover-Tech’s Controlium platform fingerprinted and de-anonymized devices, then let partners trigger infection when an ad rendered. Analysis of four billion bid records over four months found its ads on almost 200,000 unique sites and mobile apps in dozens of countries. Millions of devices contacted Candiru infrastructure, which researchers characterize as likely tracking and reconnaissance rather than evidence of mass infection. The Citizen Lab report includes the recovered sample and technical indicators. (discussion) · Threat Activity & Espionage

September 25, 2026

Corp MDM Android spyware targets logistics firms via fake Google Play pages branded CEVA and TKW Logistics, delivering com.corp.mdm disguised as a system service that steals incoming SMS and redirects calls. Have I Been Squatted, The Hacker News · Threat Activity

September 16, 2026

Iranian state actors used fake MRI results to deliver CHOSEN BRICK against dissidents, activists and journalists. A joint UK, US and Dutch warning describes extended rapport-building over WhatsApp and Telegram before delivery of tailored Windows files. The spyware persists at login and collects contacts, email and social messages, screen content and microphone audio—enabling pattern-of-life analysis that can increase victims’ physical risk (UK NCSC; The Record). · Threat Activity & Malware

September 11, 2026

Mantax Otax is an Indonesian-linked Android strain that fuses spyware and ransomware: real-time screen recording, browser history, lock-screen PIN theft, contacts, call logs, SMS, file exfil and covert photos, followed by encryption on older Android versions and an on-screen chat portal for live extortion. Sideloaded as an APK from a file-sharing host, it resolves its live C2 domain from a GitHub repo and brokers traffic through Firebase (Zimperium, BleepingComputer). Separately, GoldFactory is abusing Android Work Profile to deliver Gigabud in the same country (Dark Reading). · Threat Intelligence

July 4, 2026

Pegasus found on the phone of an EU lawmaker probing spyware. Citizen Lab reports former MEP Stelios Kouloglou was infected twice with Pegasus while serving on the European Parliament committee investigating commercial spyware abuse. Citizen Lab · The Record · Threat Intelligence