Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads
More on Zero-Click
Other advisories
- CriticalCVE-2026-52103Eine Zero-Click-Remote-Code-Ausführung (RCE)-Sicherheitslücke im Komponenten /Terminal/Notification.
- Not ratedCVE-2026-35511Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts in github.com/authorizerdev/authorizer
- HighCVE-2026-35511Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts
- Not ratedCVE-2026-35511Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts
- HighCVE-2026-21873NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS
- HighCVE-2026-40107SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering in github.com/siyuan-note/siyuan/kernel
- Not ratedosv:CVE-2026-31953Xibo CMS has Stored XSS via Notification Body with Zero-Click Execution on Login
- HighCVE-2026-40107SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering
Other news entries
- 'AdFection' Turns Ad Impressions Into Zero-Click Spyware DeliveryNewsDark Reading
- Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery ChannelNewsSecurityWeek
- Targeted ads installed Candiru spyware in zero-click attacksNewsBleepingComputer
- No click required: How the ad industry became a pipeline for mercenary spywareNewsCSO Online
- Anthropic 'SneakPeek' Flaw Is a Silent Zero-Click ThreatNewsDark Reading
- ‘SalesBleed’ Flaws in Salesforce Agentforce Enabled Zero-Click Data ExfiltrationNewsSecurityWeek
- A zero-click RCE flaw in AI coding agents could have exposed enterprise systemsNewsCSO Online
- Google Pixel phones pwned in zero-click attacksNewsThe Register — Security
Source: https://thehackernews.com/2026/10/citizen-lab-traces-zero-click-candiru.html
ID