Targeted ads installed Candiru spyware in zero-click attacks
Teaser from the source
Candiru spyware was delivered to devices at Al Jazeera Media Network via targeted online advertisements in a zero-click attack that required only rendering the malicious ads on the victim's device. [...]
This is the RSS-feed teaser. Read the full article at the original source.
Read at BleepingComputerMore on zero-click
Other advisories
- CriticalCVE-2026-52103Eine Zero-Click-Remote-Code-Ausführung (RCE)-Sicherheitslücke im Komponenten /Terminal/Notification.
- Not ratedCVE-2026-35511Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts in github.com/authorizerdev/authorizer
- HighCVE-2026-35511Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts
- Not ratedCVE-2026-35511Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts
- HighCVE-2026-21873NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS
- HighCVE-2026-40107SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering in github.com/siyuan-note/siyuan/kernel
- Not ratedosv:CVE-2026-31953Xibo CMS has Stored XSS via Notification Body with Zero-Click Execution on Login
- HighCVE-2026-40107SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering
Other news entries
- 'AdFection' Turns Ad Impressions Into Zero-Click Spyware DeliveryNewsDark Reading
- Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery ChannelNewsSecurityWeek
- No click required: How the ad industry became a pipeline for mercenary spywareNewsCSO Online
- Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online AdsNewsThe Hacker News
- Anthropic 'SneakPeek' Flaw Is a Silent Zero-Click ThreatNewsDark Reading
- ‘SalesBleed’ Flaws in Salesforce Agentforce Enabled Zero-Click Data ExfiltrationNewsSecurityWeek
- A zero-click RCE flaw in AI coding agents could have exposed enterprise systemsNewsCSO Online
- Google Pixel phones pwned in zero-click attacksNewsThe Register — Security
ID