Fourteen governments adopt first guidelines for commercial hacking firms
The non-binding Pall Mall rules ask vendors to vet customers and halt sales when misuse is a credible risk.
Stories per day · 30 days
7 RSS
Relatedzero-click20candiru17citizen-lab15discover-tech12adfection9al-jazeera9pegasus9apple8malvertising8surveillance7mercenary-spyware6nso-group5serbia5advertising4android3bsi3ios3iphone3
90 stories, newest first · one card per story
Stories tagged #spyware
Leaked DarkSword and Coruna kits infect employee iPhones
One DarkSword chain started from an Instagram ad and targeted iOS 18.4.0 through 18.7.2 to steal Keychain data and crypto.
Apple warns German lawmakers of spyware attacks
Apple sent threat notifications to users in 99 countries; German BSI urged immediate device replacement for recipients.
Apple spyware notifications reach Bundestag: BSI urges assume compromise
BSI advises Bundestag members to assume their devices may be compromised after receiving Apple alerts about mercenary spyware attacks.
Apple warns users in 99 countries of mercenary spyware
Apple issued threat notifications to suspected victims of mercenary spyware in 99 countries, including journalists in Turkey and Lebanon.
Apple issues threat alerts for mercenary spyware in 99 countries
Apple sent notifications to targeted users in 99 countries about mercenary spyware attacks, separate from August alerts.
Apple warns iPhone users in 99 countries of mercenary spyware
The October 30 notices are separate from August alerts covering 110 countries, and Apple named no spyware or flaw.
Apple warns of mercenary spyware infections in 99 countries
Recipients include journalists and filmmakers; Apple has now notified users in more than 150 countries and does not name attackers.
1
Schneier notes bloatware found in a cheap car head unit
A Civic owner reportedly used Claude to inspect an Amazon head unit and found a call recorder, Baidu location services, and an always-on WebView assistant.
Malware exposed high-stakes online poker players' cards in multi-year campaign
Hundreds of players were allegedly targeted via screen-capture malware MeshAgent spread through third-party multi-tabling tools, with millions of dollars reportedly stolen.
US and EU politicians call targeted ads a zero-click spyware risk
European Parliament members asked the EU to investigate whether institutions can be infected through online advertising.
Citizen Lab says spyware makers infect devices through online ads
Researchers say Israeli firm Discover-Tech links ad vendors to Candiru and Bindecy zero-click spyware.
1
Vučić concedes Serbian vote after reported Pegasus and Cellebrite targeting
Researchers say mercenary spyware and Cellebrite extractions hit opposition figures, journalists, a rector and a prosecutor.
1
Rentable Android spyware uCreater targets WeChat, Telegram and wallets
YingGai hooks sideloaded apps to steal chats, OTPs and wallet data and can spoof camera checks.
uCreator Android spyware steals Telegram 2FA and clones WeChat
The rentable kit hides in sideloaded Telegram and WeChat copies; its code and C2 match Doctor Web’s Baohuo.
Security Affairs newsletter round 601 recaps the week's cyber stories
The October 25 edition is a headline index covering sanctions, ransomware, PHP flaws, spyware, and AI items, with no new reporting.
1
Senators cite ad-delivered spyware; ad groups defend vetting
Citizen Lab's AdFection report says Discover-Tech ads carried zero-click mercenary spyware, including impressions on government networks.
Pegasus confirmed on Belgrade rector’s iPhone before elections
Citizen Lab reports a high-confidence zero-click infection in 2026, bringing known Serbian civil-society spyware cases to at least 16.
Pegasus confirmed on Belgrade rector's iPhone before Serbia election
Citizen Lab reports a high-confidence zero-click infection but does not name the operator, date, or flaw.
Citizen Lab says AdFection used ads to deliver Candiru spyware
Discover-Tech allegedly helped infect at least 45 Al-Jazeera devices without a victim click.
Judge denies WhatsApp contempt bid over alleged NSO injunction breach
The court said Meta’s evidence on 23 suspect accounts was not clear and convincing enough to punish NSO.
Pegasus infected another Serbian opposition figure, researchers say
Citizen Lab confirmed a Belgrade rector’s infection this year; a prosecutor’s phone is still being analyzed.
Pegasus found on Serbian critics' phones before elections
Citizen Lab reports a zero-click Pegasus infection on a Belgrade rector's phone in 2026; a prosecutor's spyware type is still unidentified.
Discover-Tech ads delivered Candiru spyware to Al Jazeera
Citizen Lab says Controlium infected devices when ads rendered, and those ads reached almost 200,000 sites and apps.