[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"public-config":3,"i-flag:ph-4x3":14,"i-flag:us-4x3":19,"i-flag:de-4x3":21,"i-flag:hk-4x3":23,"i-tabler:lifebuoy":25,"i-tabler:timeline":28,"i-tabler:apps":30,"i-tabler:package":32,"i-tabler:circle-half-2":34,"i-tabler:sun":36,"i-tabler:moon":38,"i-tabler:menu-2":40,"i-tabler:user":42,"i-tabler:notebook":44,"i-simple-icons:forgejo":46,"i-tabler:shield-lock":48,"i-tabler:tools":50,"i-tabler:calendar":52,"i-tabler:x":54,"$fs6rbiy7t7xw3":56,"i-tabler:arrow-left":123,"i-tabler:tag":125},{"matomo":4,"booking":7,"site":9,"blog":11,"newsletter":12},{"enabled":5,"siteId":6},true,"7",{"enabled":5,"url":8},"https:\u002F\u002Fcal.com\u002Fjdbungart",{"url":10},"https:\u002F\u002Fjdneer.com",{"enabled":5},{"enabled":13},false,{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":18},0,640,480,"\u003Cpath fill=\"#0038a8\" d=\"M0 0h640v240H0z\"\u002F>\u003Cpath fill=\"#ce1126\" d=\"M0 240h640v240H0z\"\u002F>\u003Cpath fill=\"#fff\" d=\"M415.7 240L0 480V0\"\u002F>\u003Cpath fill=\"#fcd116\" d=\"M26.7 42.4L41 55l16.6-9.2l-7.4 17.5l14 13l-19-1.6l-8.1 17.2l-4.3-18.5L14 71l16.3-10zm323.8 172.3l.4 19l18 6.3l-18 6.2l-.4 19l-11.5-15.1l-18.2 5.5l10.8-15.6l-10.8-15.6l18.2 5.5zM37.2 388.1l8 17.2l19-1.6l-13.9 13l7.4 17.5l-16.6-9.1l-14.4 12.4l3.6-18.7L14 409l18.9-2.4zm114.2-249l-6.2 6.2l3.1 47l-3 .3l-5.7-42.9l-5.1 5l7.6 38.4a48 48 0 0 0-17.2 7.1l-21.7-32.4H96l26.4 34.3l-2.4 2l-31.1-35.5h-8.8v8.8l35.4 31l-2 2.5l-34.3-26.3v7.1l32.5 21.7q-5.2 7.8-7.1 17.2L66.3 223l-5.1 5l42.9 5.7q-.3 1.6-.3 3.1l-47-3l-6.2 6.2l6.2 6.2l47-3.1l.3 3.1l-42.9 5.7l5 5l38.4-7.6a48 48 0 0 0 7.1 17.2l-32.5 21.7v7.2l34.3-26.3l2 2.4l-35.4 31v8.8H89l31-35.4l2.5 2L96 312.2h7.2l21.7-32.5q7.8 5.2 17.2 7.1l-7.6 38.4l5 5l5.7-42.9q1.5.3 3.1.3l-3 47l6.1 6.2l6.3-6.2l-3.1-47l3-.3l5.7 43l5.1-5.1l-7.6-38.4a48 48 0 0 0 17.2-7.1l21.7 32.5h7.2l-26.4-34.3l2.4-2l31.1 35.4h8.8v-8.8l-35.4-31l2-2.4l34.3 26.3v-7.2l-32.5-21.7q5.2-7.8 7.1-17.2l38.3 7.6l5.1-5l-42.9-5.7q.3-1.5.3-3.1l47 3l6.2-6.1l-6.2-6.2l-47 3l-.3-3l42.9-5.7l-5-5l-38.4 7.5a48 48 0 0 0-7.1-17.2l32.5-21.7v-7.1l-34.3 26.3l-2-2.4l35.4-31v-8.9H214l-31 35.5l-2.5-2l26.4-34.3h-7.2L178 200.2q-7.8-5.2-17.2-7.1l7.6-38.3l-5-5l-5.7 42.8l-3.1-.3l3-47z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":20},"\u003Cpath fill=\"#bd3d44\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath stroke=\"#fff\" stroke-width=\"37\" d=\"M0 55.3h640M0 129h640M0 203h640M0 277h640M0 351h640M0 425h640\"\u002F>\u003Cpath fill=\"#192f5d\" d=\"M0 0h364.8v258.5H0\"\u002F>\u003Cmarker id=\"SVGEq3dreKJ\" markerHeight=\"30\" markerWidth=\"30\">\u003Cpath fill=\"#fff\" d=\"m14 0l9 27L0 10h28L5 27z\"\u002F>\u003C\u002Fmarker>\u003Cpath fill=\"none\" marker-mid=\"url(#SVGEq3dreKJ)\" d=\"m0 0l16 11h61h61h61h61h60L47 37h61h61h60h61L16 63h61h61h61h61h60L47 89h61h61h60h61L16 115h61h61h61h61h60L47 141h61h61h60h61L16 166h61h61h61h61h60L47 192h61h61h60h61L16 218h61h61h61h61h60z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":22},"\u003Cpath fill=\"#fc0\" d=\"M0 320h640v160H0z\"\u002F>\u003Cpath fill=\"#000001\" d=\"M0 0h640v160H0z\"\u002F>\u003Cpath fill=\"red\" d=\"M0 160h640v160H0z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":24},"\u003Cpath fill=\"#ec1b2e\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath id=\"SVG5tfvBPpj\" fill=\"#fff\" d=\"M346.3 103.1C267 98 230.6 201.9 305.6 240.3c-26-22.4-20.6-55.3-10.1-72.4l1.9 1.1c-13.8 23.5-11.2 52.7 11.1 71c-12.7-12.3-9.5-39 12.1-48.9s23.6-39.3 16.4-49.1q-14.7-25.6 9.3-38.9M307.9 164l-4.7 7.4l-1.8-8.6l-8.6-2.3l7.8-4.3l-.6-8.9l6.5 6.1l8.3-3.3l-3.7 8.1l5.6 6.8z\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(72 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(144 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(216 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(288 312.5 243.5)\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":27},24,"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0\"\u002F>\u003Cpath d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m12 3l3.35 3.35M9 15l-3.35 3.35m0-12.7L9 9m9.35-3.35L15 9\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":29},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"m4 16l6-7l5 5l5-6\"\u002F>\u003Cpath d=\"M14 14a1 1 0 1 0 2 0a1 1 0 1 0-2 0M9 9a1 1 0 1 0 2 0a1 1 0 1 0-2 0m-6 7a1 1 0 1 0 2 0a1 1 0 1 0-2 0m16-8a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":31},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm0 10a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm10 0a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1h-4a1 1 0 0 1-1-1zm0-8h6m-3-3v6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":33},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 3l8 4.5v9L12 21l-8-4.5v-9zm0 9l8-4.5M12 12v9m0-9L4 7.5m12-2.25l-8 4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":35},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m9-9v18m0-7l7-7m-7 12l8.5-8.5M12 9l4.5-4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":37},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":39},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":41},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":43},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 7a4 4 0 1 0 8 0a4 4 0 0 0-8 0M6 21v-2a4 4 0 0 1 4-4h4a4 4 0 0 1 4 4v2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":45},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M6 4h11a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a1 1 0 0 1-1-1V5a1 1 0 0 1 1-1m3 0v18m4-14h2m-2 4h2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":47},"\u003Cpath fill=\"currentColor\" d=\"M16.777 0a2.9 2.9 0 1 1-2.529 4.322H12.91a4.266 4.266 0 0 0-4.265 4.195v2.118a7.08 7.08 0 0 1 4.147-1.42l.118-.002h1.338a2.9 2.9 0 0 1 5.43 1.422a2.9 2.9 0 0 1-5.43 1.422H12.91a4.266 4.266 0 0 0-4.265 4.195v2.319A2.9 2.9 0 0 1 7.222 24A2.9 2.9 0 0 1 5.8 18.57V8.589a7.11 7.11 0 0 1 6.991-7.108l.118-.001h1.338A2.9 2.9 0 0 1 16.778 0M7.223 19.905a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389m9.554-10.464a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.39m0-7.735a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":49},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M12 3a12 12 0 0 0 8.5 3A12 12 0 0 1 12 21A12 12 0 0 1 3.5 6A12 12 0 0 0 12 3\"\u002F>\u003Cpath d=\"M11 11a1 1 0 1 0 2 0a1 1 0 1 0-2 0m1 1v2.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":51},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M3 21h4L20 8a1.5 1.5 0 0 0-4-4L3 17zM14.5 5.5l4 4\"\u002F>\u003Cpath d=\"M12 8L7 3L3 7l5 5M7 8L5.5 9.5M16 12l5 5l-4 4l-5-5m4 1l-1.5 1.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":53},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 7a2 2 0 0 1 2-2h12a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2zm12-4v4M8 3v4m-4 4h16m-9 4h1m0 0v3\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":55},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"slug":57,"title":58,"excerpt":59,"image":60,"publishedAt":61,"topics":62,"readMinutes":69,"html":70,"metaTitle":58,"metaDescription":71,"shareImage":72,"updatedAt":61,"author":76,"related":79},"citizen-lab-targeted-ads-delivered-zero-click-spyware-to-al-jazeera-devices","Citizen Lab: Targeted Ads Delivered Zero-Click Spyware to Al Jazeera Devices","Citizen Lab says it has confirmed, for the first time, zero-click mercenary spyware delivered through targeted ads. Israeli firm Discover-Tech bought the ads that infected Al Jazeera devices with Candiru spyware, and its ads reached nearly 200,000 apps and sites.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fcitizenlab_adfection_feature.png","2026-10-21T14:00:00.000+08:00",[63,66],{"key":64,"label":65},"security","Security",{"key":67,"label":68},"news","News",5,"\u003Cp>Researchers at the Citizen Lab say they have, for the first time, publicly confirmed zero-click mercenary spyware being delivered through targeted online advertising. In a report published on October 15, 2026, \u003Ca href=\"https:\u002F\u002Fcitizenlab.ca\u002Fresearch\u002Fhow-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware\u002F?ref=ghost.jdneer.com\">\u003Cstrong>Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware\u003C\u002Fstrong>\u003C\u002Fa>, the Citizen Lab names the technique AdFection and ties it to the infection of devices at Al Jazeera with spyware from Candiru, the Israeli vendor that has since rebranded as Integrity Labs.\u003C\u002Fp>\u003Cp>At the center of the story is Discover-Tech, an Israeli company that presents itself as an ordinary ad buyer. According to the report, the company bought the malicious ads and runs a platform called Controlium that lets its customers single out a device and infect it the moment an ad renders, with no click required.\u003C\u002Fp>\u003Cblockquote>\"Discover-Tech operates a platform called Controlium that enables its mercenary partners to de-anonymize, fingerprint, and automatically infect devices the moment an advertisement is rendered…\"\u003Cbr \u002F>\u003Cbr \u002F>The Citizen Lab, Key Findings\u003C\u002Fblockquote>\u003Ch2 id=\"how-an-ad-becomes-an-infection\">How an ad becomes an infection\u003C\u002Fh2>\u003Cp>Most ads today are sold in real-time auctions that happen in under a second, and the winning ad can carry code that runs inside the browser or app showing it. The researchers found that a large share of Discover-Tech's ads carried a script tag pointing back to what the company calls a NOAS server. When the ad loads, it reports the viewer's cookie ID or mobile advertising ID, and the server decides, apparently based on those identifiers and the source IP address, whether to send back JavaScript. Most viewers get an empty response. Selected targets get code. Because the payload never sits in the ad itself, Discover-Tech avoids sharing malicious code, or even pointers to it, with the companies that serve and display the ads.\u003C\u002Fp>\u003Cp>Inside Controlium, customers can pick a target by iOS or Android advertising ID, browser cookie ID or IP address, choose which ad platform delivers the ad, and set \"OpSec\" limits on how widely they bid. The lab reconstructed the interface from frontend code that was publicly served on the platform's login page. It also found an unauthenticated endpoint that exposed 128 days of login records covering 120 distinct usernames, and a flawed authentication design it believes an attacker could have abused. The researchers say they did not test that flaw.\u003C\u002Fp>\u003Ch2 id=\"the-al-jazeera-attacks\">The Al Jazeera attacks\u003C\u002Fh2>\u003Cp>The report says at least 45 devices inside Al Jazeera were targeted in a series of zero-click attacks in 2024 and 2025, which the lab links with high confidence to Candiru spyware delivered through Discover-Tech ads. Network logs supplied by Al Jazeera show a consistent sequence: contact with Discover-Tech ad infrastructure, then a Candiru \"validator\" server that checks the device, then a Candiru command-and-control server. A Windows DLL recovered from one compromised machine shares distinctive traits with the Candiru chain the lab documented in 2021, including COM hijack persistence and a 48-byte repeating XOR string obfuscation scheme. Using a server fingerprint, the researchers counted 305 Candiru validator domains on 319 IP addresses between August 2022 and July 2026.\u003C\u002Fp>\u003Ch2 id=\"billions-of-bids-nearly-200000-apps-and-sites\">Billions of bids, nearly 200,000 apps and sites\u003C\u002Fh2>\u003Cp>The lab also found two publicly readable databases on a Discover-Tech domain holding almost four billion bidding records. Between March and June 2026, Discover-Tech's MyDSP platform bid on about 3.77 billion impressions and won roughly 442 million. Ads carrying the attacker script tag appeared in 75,373 Android and iOS apps and on 120,768 websites. The report lists widely used apps such as MX Player and Viber, along with sites including Weather.com, yahoo.com, bbc.com and nytimes.com. By raw bids, Yemen, Pakistan and Montenegro topped the list of countries.\u003C\u002Fp>\u003Cp>The researchers stress that an ad impression alone does not confirm targeting or infection, but they recorded impressions on networks belonging to NATO, the United Nations, EU institutions, ministries of defense and foreign affairs, critical infrastructure operators and media organizations. They also found little sign of a real advertising business: the database recorded zero conversions, and most ads promoted sites and apps the lab links to Discover-Tech itself.\u003C\u002Fp>\u003Cp>Beyond Al Jazeera, the report connects Discover-Tech to other surveillance players, including the hacking firm Bindecy and the ad intelligence vendor Intelos. It describes a separate actor, which it calls DARK CARTOGRAPHER, that used Discover-Tech's infrastructure to exploit weaknesses at mobile carriers in more than 30 countries to link advertising IDs to phone numbers. A fuller report on that actor is planned.\u003C\u002Fp>\u003Ch2 id=\"certified-by-the-industry-it-exploited\">Certified by the industry it exploited\u003C\u002Fh2>\u003Cp>Discover-Tech appeared on lists of certified and approved vendors maintained by Google and IAB Europe from 2020 until early October 2026, and served ads through networks including Google, Yandex and Beeswax. After the lab's disclosure, Google, IAB Europe, Beeswax, Vungle (Liftoff) and Eskimi moved to cut off its access. The report was co-timed with an investigation by the ad security firm Confiant.\u003C\u002Fp>\u003Cblockquote>\"Discover-Tech's mass abuse, privacy invasion, and facilitation for mercenary spyware attacks illustrates structural flaws with the online advertising system, which failed to detect or prevent the abuse documented in this report.\"\u003Cbr \u002F>\u003Cbr \u002F>The Citizen Lab, Key Findings\u003C\u002Fblockquote>\u003Cp>The authors, Bill Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis and Ron Deibert, call on regulators to investigate whether Discover-Tech and Candiru\u002FIntegrity Labs broke applicable laws, and they offer recommendations for lawmakers, defenders and the advertising industry. The full report, including indicators of compromise and the companies' responses, is \u003Ca href=\"https:\u002F\u002Fcitizenlab.ca\u002Fresearch\u002Fhow-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware\u002F?ref=ghost.jdneer.com\">available from the Citizen Lab\u003C\u002Fa>.\u003C\u002Fp>\u003Ch2 id=\"are-you-affected\">Are you affected?\u003C\u002Fh2>\u003Cp>Most people will never be targeted this way, but the \u003Ca href=\"https:\u002F\u002Fcitizenlab.ca\u002Fresearch\u002Fhow-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware\u002F?ref=ghost.jdneer.com\">Citizen Lab report\u003C\u002Fa> is blunt that \"there is currently no consistently safe way to expose your users and networks to targeted ads.\" Its guidance for defenders and individuals comes down to a few steps.\u003C\u002Fp>\u003Cul>\u003Cli>\u003Cstrong>Block ads at the gateway.\u003C\u002Fstrong> Citizen Lab recommends blocking online advertising at the network edge and on work-issued devices. On a dnsmasq or Pi-hole style resolver, a single domain can be sinkholed with a line such as \u003Ccode>address=\u002Fcontrolium.net\u002F0.0.0.0\u003C\u002Fcode>; with Unbound, use \u003Ccode>local-zone: \"controlium.net.\" always_nxdomain\u003C\u002Fcode>. A maintained ad-blocking list covers far more than these few domains.\u003C\u002Fli>\u003Cli>\u003Cstrong>Turn off ad targeting on phones.\u003C\u002Fstrong> The report says Discover-Tech's methods can be blocked directly by blocking advertising identifiers. Organizations can disable advertising IDs through MDM. Individually, on Android 12 and later go to Settings, Privacy, Ads and delete the advertising ID; on iPhone, go to Settings, Privacy & Security, Tracking and turn off Allow Apps to Request to Track (\u003Ca href=\"https:\u002F\u002Fssd.eff.org\u002Fmodule\u002Fhow-to-get-to-know-iphone-privacy-and-security-settings?ref=ghost.jdneer.com#disable-ad-tracking\">EFF guide\u003C\u002Fa>).\u003C\u002Fli>\u003Cli>\u003Cstrong>Use an ad blocker and a browser with tracking protection.\u003C\u002Fstrong> Citizen Lab suggests a trusted ad-blocking extension, a privacy-respecting browser with Global Privacy Control support, and network-level ad blocking at the home router or through a VPN service that offers it.\u003C\u002Fli>\u003Cli>\u003Cstrong>If you are at elevated risk,\u003C\u002Fstrong> such as journalists, activists or people working on sensitive files, Citizen Lab \"strongly\" recommends seeking expert help, and points to the personalized steps in \u003Ca href=\"https:\u002F\u002Fsecurityplanner.consumerreports.org\u002F?ref=ghost.jdneer.com\">Security Planner\u003C\u002Fa>.\u003C\u002Fli>\u003C\u002Ful>\u003Cp>\u003Cstrong>Search your DNS or proxy logs for the infrastructure named in the report.\u003C\u002Fstrong> These include Discover-Tech's Controlium and ad-delivery domains (controlium[.]net, powerium[.]net, mtrtb[.]com), the Candiru validator servers seen at Al Jazeera (keyadapter[.]com, sharethere[.]net), and the C&C servers that matched Citizen Lab's fingerprint (fearevolve[.]com, insightenterprisells[.]com, jobmarcher[.]com, plasticbells[.]com). Adjust the log path for your resolver or proxy:\u003C\u002Fp>\u003Cpre>\u003Ccode>grep -Ei 'controlium\\.net|powerium\\.net|mtrtb\\.com' \\\n  \u002Fvar\u002Flog\u002Fdns\u002F*.log\ngrep -Ei 'keyadapter\\.com|sharethere\\.net' \u002Fvar\u002Flog\u002Fdns\u002F*.log\ngrep -Ei 'fearevolve\\.com|insightenterprisells\\.com' \\\n  \u002Fvar\u002Flog\u002Fdns\u002F*.log\ngrep -Ei 'jobmarcher\\.com|plasticbells\\.com' \u002Fvar\u002Flog\u002Fdns\u002F*.log\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>Citizen Lab says infected devices first contacted Discover-Tech infrastructure (the ad impression), then a Candiru validator server, then a Candiru C&C server. A hit in that order is worth escalating. The report lists 305 validator domains in total, so this short list is a starting point, not a full sweep.\u003C\u002Fp>","Citizen Lab says it has confirmed, for the first time, zero-click mercenary spyware delivered through targeted ads. Israeli firm Discover-Tech bought the...",{"src":60,"width":73,"height":74,"type":75},1600,900,"image\u002Fpng",{"name":77,"url":78,"owner":13},"Aiko Tanaka",null,[80,92,103,114],{"slug":81,"title":82,"excerpt":83,"image":84,"publishedAt":85,"topics":86,"readMinutes":91},"http2shell-cve-2026-111497-brotli-decoder","HTTP2Shell (CVE-2026-111497): What the Brotli Decoder Bug Really Hits, and How to Patch","CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, 1.0.3 through 1.2.0. Fixed in 1.0.10, 1.1.1 and 1.2.1, plus Node.js, Bun, Python, Envoy and .NET updates. You are exposed if you decode untrusted Brotli data. Not in CISA KEV.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fhttp2shell_cve_2026_111497_v2.png","2026-10-26T20:51:27.000+08:00",[87,90],{"key":88,"label":89},"advisories","Advisories",{"key":64,"label":65},1,{"slug":93,"title":94,"excerpt":95,"image":96,"publishedAt":97,"topics":98,"readMinutes":91},"package-cooldowns-github-package-firewall-npm-pnpm-bun-pip-uv-poetry","Package Cooldowns Compared: GitHub Package Firewall vs. What npm, pnpm, Yarn, Bun, pip, uv and Poetry Already Do","GitHub now offers an install-time firewall for npm, free in preview and metered later. Most package managers already ship a free cooldown. Here is what each tool does, the copy-paste config, and where cooldowns stop helping.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fpkg-cooldowns-conveyor-alberto-rodriguez-unsplash.jpg","2026-10-26T14:00:00.000+08:00",[99,102],{"key":100,"label":101},"guides","Guides",{"key":64,"label":65},{"slug":104,"title":105,"excerpt":106,"image":107,"publishedAt":108,"topics":109,"readMinutes":91},"tailscale-ssh-tailworm-mesh-vpn-agent-risk","Your Mesh VPN Agent Is Root on Every Box. Tailworm Is the Reminder.","A researcher showed one hacked Tailscale node reaching root on other servers through Tailscale SSH forwarding. No patch yet. Here is why mesh VPN agents deserve the same suspicion as any privileged daemon.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Ftailworm-padlock-light-trails-flyd-unsplash.jpg","2026-10-26T12:00:00.000+08:00",[110,113],{"key":111,"label":112},"opinion","Opinion",{"key":64,"label":65},{"slug":115,"title":116,"excerpt":117,"image":118,"publishedAt":119,"topics":120,"readMinutes":91},"emudhra-ca-weak-keys-chain-of-trust","eMudhra Broke Almost Nothing, and Still Dented the Chain of Trust","Eight eMudhra intermediate CA keys turned out to be numbers under 256. Browsers blocked them within hours, almost no site broke, and eMudhra is leaving the TLS business. The service impact was tiny. The lesson for the chain of trust is not.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Femudhra-keys-iolandino-baiano-unsplash.jpg","2026-10-25T16:00:00.000+08:00",[121,122],{"key":111,"label":112},{"key":64,"label":65},{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":124},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M5 12h14M5 12l6 6m-6-6l6-6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":126},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M6.5 7.5a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003Cpath d=\"M3 6v5.172a2 2 0 0 0 .586 1.414l7.71 7.71a2.41 2.41 0 0 0 3.408 0l5.592-5.592a2.41 2.41 0 0 0 0-3.408l-7.71-7.71A2 2 0 0 0 11.172 3H6a3 3 0 0 0-3 3\"\u002F>\u003C\u002Fg>"]