همهٔ اخبار

Targeted ads delivered 0-click exploits to install mercenary malware

The incident is likely 1st confirmation of mercenary spyware delivered by targeted ads.

Zero-click spyware infecting devices through online ads, researchers say

Powerful zero-click spyware is infected devices worldwide through targeted ads, new research shows — an alarming development in the spread of surveillance technology.

ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More

Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week's security stories. The rest gets interesting in different ways. A small permission can lead to a big theft. A trusted login can hide the wrong person. Old bugs are finding new victims, familiar tools are being put to strange uses, and

Silent Lynx: Kazakhstan-Linked Hackers Target Russian Refinery and Government

Silent Lynx, a group likely based in Kazakhstan, targets Russian energy and government entities in espionage campaigns across Central Asia. Researchers from Cisco Talos and Recorded Future published a detailed paper on a threat actor they call Silent Lynx (aka UAT-6275, TAG-193), a Kazakhstan nexus group conducting espionage across Central Asia. The targets include the […]

آسیب‌پذیری در سامانه‌های انتقال فایل؛ بررسی رخداد امنیتی ShareFile

سامانه‌های انتقال فایل در سازمان‌ها برای جابه‌جایی اطلاعات میان کاربران، سرورها و شبکه‌های مختلف استفاده می‌شوند. بااین‌حال، اگر خود این سامانه‌ها دچار آسیب‌پذیری امنیتی باشند، ممکن است مسیر دسترسی غیرمجاز به فایل‌ها یا زیرساخت سازمان را فراهم کنند؛ حتی زمانی که فایل‌ها از نظر وجود بدافزار بررسی می‌شوند.

An Israeli firm is sending zero-click spyware through online ads

Online ads infected targets with Candiru spyware in zero-click attacks

Citizen Lab has uncovered targeted advertising campaigns that infected devices at Al Jazeera with Candiru spyware without requiring users to click anything. The researchers call the technique “AdFection” and describe their findings as the first public technical confirmation of mercenary spyware delivered through targeted ads. The investigation identifies Israeli advertising company Discover-Tech as the intermediary ……

Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads

Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that needed no click or other action from the user, researchers at the Citizen Lab said Thursday. The hidden attack code ran the moment an ad loaded on the screen, and in some cases the ad loaded out of sight, in the background. The Citizen

Spyware vendors found a way to make targeted ads even worse

Israeli adtech outfit allegedly helped spyware vendors infect phones while enjoying Google's seal of approval

AdFection: Beyond the Click: Citizen Lab Exposes Ad-Delivered Spyware Networks

Spyware vendors use online ad infrastructure to profile targets and deliver exploits without requiring users to click anything. The investigation links Discover-Tech to Candiru, an Israeli spyware vendor that the US government placed on its Entity List in 2021. Candiru has since used the name Integrity Labs. Citizen Lab also identified links involving other surveillance […]

KGB RAT trojan packs webcam spying, password theft and a “fun” menu to terrorize victims

A Windows trojan advertised on hacking forums for as little as $150 a month promises buyers access to a victim’s webcam, microphone, keystrokes and saved passwords, and comes with a set of features made to frighten the person on the other side of the screen. The malware, called KGB RAT, was analyzed by Group-IB malware analysts Alpomish Asadov and Razvan Raducu, who found that it is built on NjRAT, a well-known remot…

Fake CAPTCHAs are tricking users into running malware on their own devices

Fake CAPTCHA checks are being used to do more than hide phishing pages. Attackers are turning the familiar “prove you’re human” step into a gateway for malware downloads, malicious browser notifications, and commands that victims are tricked into running themselves, according to Barracuda. The company found CAPTCHA abuse in 43% of the phishing-kit attacks it examined during 2025. These checks help attackers gain user…

The 2026 Infostealer Intelligence Shortlist: Top 10 Vendors Security Teams Should Know

Infostealer intelligence has become one of the important tool in cybersecurity as malware has become one of the most efficient tools in a cybercriminal's kit. A single infected laptop can leak saved passwords, browser cookies, autofill data, and enough machine details for an attacker to impersonate the user outright. Stolen session cookies are especially damaging because they let intruders skip multi-factor authentic…

Israeli firm's digital ads enabling installation of 'zero-click' spyware

Is this link safe? Find out with Malwarebytes Scam Link Check

Not sure if a link is safe? Malwarebytes Scam Link Check scans suspicious links for signs of phishing, scams, malware, and other online threats before you click.

Cisco warns of actively exploited Secure Email Gateway flaw

A critical vulnerability affecting Cisco’s Secure Email Gateway product is allowing attackers towrite arbitrary files on the underlying operating system. In an advisory issued on Wednesday, the company urged customers to apply available fixes after confirming that the flaw is being exploited in the wild. The flaw affects the product’s Advanced Malware Protection (AMP) feature and stems from improper handling of email…

Fake Traffic Challan Texts Are Stealing UPI PINs From Android Users in India

A text message about an unpaid traffic challan could cost Android users in India far more than a fine. GhostBat RAT, an Android malware strain first identified by cybersecurity firm Cyble in October 2025, has evolved to capture PINs from 60 banking, UPI apps, wallet and fintech applications, according to new research published by Cyble. The firm's investigation into fake mParivahan and eChallan apps also exposed a wi…

Attackers exploit Palo Alto PAN-OS flaw for root access as CISA orders three-day fix

Attackers are exploiting a newly disclosed flaw in Palo Alto Networks’ PAN-OS firewall software to run code with root privileges, and US federal agencies have been ordered to fix it and check for compromise by October 17. Palo Alto Networks disclosed the vulnerability, tracked as CVE-2026-0322, in a security advisory published October 14. The flaw “enables an authenticated attacker with network access to execute arbi…

Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early

Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns between April and October of 2026. The campaigns also increase operational pressure on MSSPs serving US businesses, which accounted for 16% of country-attributed targets. Similar attacks

Ransomware extortion gets personal as attackers target employees’ families

Ransomware attackers are expanding their tactics beyond encrypting corporate systems and threatening to leak stolen data. They are increasingly using AI in attacks, exploiting organizations’ own AI systems and even using physical intimidation by threatening employees and their families to pressure companies into paying ransoms. The Semperis’ 2026 Ransomware Risk Report found that 84% of surveyed ransomware victims ex…

2026-017: Critical Vulnerability in Cisco Secure Email Gateway

On 14 October 2026, Cisco published a security advisory addressing a critical vulnerability affecting the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. This vulnerability could allow an unauthenticated, remote attacker to write arbitrary files and execute commands with root privileges on the underlying operating system. The Cisco PSIRT is aware of active exploitation of this vulnerability.…

CikaBika Bot RAT Uses Discord for C&C

Delivered via phishing, the malware provides reconnaissance, remote execution, and data exfiltration capabilities. The post CikaBika Bot RAT Uses Discord for C&C appeared first on SecurityWeek.

Zero-Click Spyware Delivered via Targeted Ads: AdFection

US Air Force pilots used malware-laden USB drives to plan Afghanistan missions

The term military intelligence seems like an oxymoron in this case

Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies

The Hirudo malware combines elements of a traditional banking trojan and a full-featured RAT. The post Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies appeared first on SecurityWeek.

‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads

Researchers at The Citizen Lab have for the first time released technical evidence of sophisticated mercenary spyware being distributed via online advertising.

Citizen Lab says governments are abusing online ads to hack people with ‘zero-click’ spyware

The digital rights unit found evidence that dozens of devices at media organization Al Jazeera were hacked after being shown malicious online ads.

AdFection: How mercenary spyware invades victims’ devices through targeted advertising

Researchers say the attacks have serious implications for the online advertising world, and regulators. The post AdFection: How mercenary spyware invades victims’ devices through targeted advertising appeared first on CyberScoop.

The GhostX Ecosystem: Forged in Transit, Licensed to Deceive

Executive Summary Cyble has continued tracking GhostBat RAT activity targeting Android users in India since its initial identification in October 2025. Recent investigations into malicious mParivahan and eChallan-themed applications revealed a broader operator-controlled ecosystem that we track as GhostX. Analysis of the exposed GhostX backend identified administrative and user-management structures, device-control r…

Hirudo Android Trojan Replaces Banking Apps to Steal Credentials

Android trojan Hirudo replaces genuine banking apps with modified versions to steal credentials and bypass security checks, enabling financial fraud. ThreatFabric researchers detailed a new Android banking trojan called Hirudo that takes a genuinely different approach to defeating banking security. Instead of throwing a fake login screen over the real app, it uninstalls the real […]