Thread 🧵
1/ NEW REPORT: Billions of advertising auctions determine in real time which ads we see on websites and in apps every day. Our latest research shows how the same data fueling this advertising ecosystem is being used to profile millions of users and silently infect targets with zero-click mercenary spyware, a novel attack technique we call "Adfection.”

Read the report: citizenlab.ca/research/how-d…

That online ad you saw for earbuds, a drone or bubble gum-scented car air freshener may have been a gateway for mercenary spyware that can infect your device without you ever having to click on it.

The Citizen Lab at the University of Toronto on Thursday said it was revealing ro-click spyware being delivered through targeted advertising, which it’s calling AdFection. It concluded that while the Israeli company Discover-Tech presents itself as a legitimate advertising firm, in actuality it operates as a facilitator for multiple mercenary spyware partners, including the well-known Candiru. Its ads covertly direct millions of devices to contact Candiru’s servers. scoopmedia.co/4BiqH8Z

In a timely discussion about Canada’s proposed Lawful Access Act @KateRobertson_ highlights the importance of repairing and preventing vulnerabilities “rather than drilling more holes in our every day communications systems.”

Listen to the full conversation hosted by @TCIS_Canada: youtube.com/watch?v=u_4UTH…

1/ Citizen Lab researchers Kate Pundyk, Siena Anstis, and @mmichae1sen discuss the rise of AI-enabled digital transnational repression in their piece for @just_security.

justsecurity.org/159245/how-gen…

2/ A recent report from Anthropic’s Threat Intelligence team gives direct evidence that generative AI is “being incorporated into the machinery of cross-border repression,” enabling authoritarian governments to identify, monitor, and target diaspora activists and exiled dissidents around the world.

3/ Pundyk, Anstis, and Michaelsen argue that the misuse of technology produced by AI companies can have an adverse impact on human rights without protocols for responding to AI-enabled digital transnational repression.

Together with @saskiabricmont and 33 other MEPs from 5 political groups, we urge @Europarl_EN, @EU_Commission, and @EUCouncil to investigate their exposure to zero-click spyware.

More in our letter:

1/2

Director @RonDeibert gave a keynote address at SecTor 2026, warning that spyware and surveillance have been “super-charged” thanks to AI. Read about his talk in @DarkReading.

darkreading.com/cyber-risk/cit…

🚨NEW INVESTIGATION: University of Belgrade Rector who resisted crackdown on students was hacked with zero-click Pegasus.

Authorities raided his offices in March.

Serbia's snap elections are 6 days away.

There are more targets 1/

With @ShareConference citizenlab.ca/research/pegas…

1/“The assumption by government officials that technology companies can find “safe ways” to weaken critical cybersecurity protections badly misreads the current threat landscape,” writes the Citizen Lab’s @KateRobertson_ in her new piece on Bill C-22 for @globeandmail.

theglobeandmail.com/opinion/articl…

3/The bill would force the stockpiling of all Canadians’ sensitive metadata, and everything from smartphones, smartwatches, banking apps, health apps, video game platforms, and public WiFi or CCTV networks could be accessed by law enforcement.

4/Robertson argues that strong encryption is critical to cybersecurity, and that government efforts to create lawful-access mechanisms, surveillance capabilities, or backdoors in communication technologies makes all Canadians less safe.

3/The bill would force the stockpiling of all Canadians’ sensitive metadata, and everything from smartphones, smartwatches, banking apps, health apps, video game platforms, and public WiFi or CCTV networks could be accessed by law enforcement.

4/Robertson argues that strong encryption is critical to cybersecurity, and that government efforts to create lawful-access mechanisms, surveillance capabilities, or backdoors in communication technologies makes all Canadians less safe.

Al Jazeera Media Network condemns the spyware attacks targeting a number of its staff, as documented in a Citizen Lab report released today. Al Jazeera worked voluntarily with Citizen Lab's researchers, and, as the report notes, that cooperation helped verify and publicly document these attacks. The Network has taken, and continues to take, appropriate steps to protect its staff and systems.

The targeting of journalists is an attack on press freedom and on the public's right to know. Those responsible must be held accountable.

4/ Our research shows devices at international news network Al Jazeera were infected with mercenary spyware from Candiru (rebranded as “Integrity Labs”) via targeted online advertisements.

5/This report presents the first public technical documentation of in-the-wild infection of devices with zero-click mercenary spyware via targeted advertisements.