decrypted · 17 october 2026 · vulnerabilities and patching · supply chain · surveillance and privacy

Candiru spyware delivered through adverts: when the ad is the exploit

A spyware vendor does not need you to click anything if it can simply pay to be shown to you. On 15 October the research group Citizen Lab published "Exposing AdFection", describing how an advertising technology firm, Discover-Tech, let customers aim a hostile advert at one named device, and how Candiru, an Israeli spyware maker that says it sells only to governments, used that to infect staff at Al Jazeera.

How an advert becomes a weapon

Think of the ad exchange as a sorting office that delivers a leaflet to millions of doors. Discover-Tech's leaflets were blank for almost everyone. For one chosen address they spoke up and gave instructions.

Mechanically, Discover-Tech bought ad space through mainstream exchanges. Each advert carried a script tag pointing at its own server. When the advert rendered, that server received the device's advertising ID and IP address and decided whether it was an eligible target. If not, it returned nothing. If so, it returned JavaScript. Citizen Lab says the ad platforms never saw the malicious code or a pointer to it. In the Al Jazeera cases the sequence ran from impression to a Candiru validation server, then profiling and infection, then a command server. No click was needed.

The scale, and what it does not prove

At least 45 devices at Al Jazeera were targeted in 2024 and 2025. Across about four billion bid records from March to June 2026, Discover-Tech's platform bid on about 3.77 billion impressions and won about 442 million.

Adverts appeared in about 75,000 apps and 120,000 websites, including on European Parliament, Commission and Council networks and Nordic, Czech, Italian and Norwegian government networks, though an impression is not an infection. The findings we could read do not name UK networks, but that is absence of evidence, not evidence of absence.

The Secure by Design lesson, and what it costs

The flawed design decision is trust by certificate. Discover-Tech was listed as a certified or approved vendor by Google and IAB Europe, and it used IAB Europe's consent framework to handle GDPR (the data protection law) consent for European users. The payload appeared only for the victim, so a vendor check had nothing to see.

After disclosure, Google, IAB Europe, Beeswax, Vungle and Eskimi cut the firm off. Citizen Lab wants regulators to investigate and ad vendors to audit "certified" partners. Whether the ICO, the Information Commissioner's Office, looks at this is a fair question for the UK.

Treat advertising as an untrusted code channel into every browser you own:

Block advertising and tracking at the gateway and on work-issued devices.
Switch off advertising IDs on company phones through MDM, central control of phones and laptops.
Monitor ad-related traffic for malicious requests, and use the server fingerprints Citizen Lab published to hunt for Candiru.

The cost is a few broken pages and a chat with marketing.

Also this week

Nextcloud's built-in Collabora server is being exploited (vulns). CVE-2026-110447, the public reference number for the flaw, affects the richdocumentscode app before version 26.4.303. An unauthenticated attacker can run commands as the web server user through the proxy.php endpoint, but only while the built-in server is stopped, for example after a restart, upgrade or crash. The advisory scores it 9.2 under CVSS v4, the zero-to-ten severity score. Only the optional built-in server app is affected; standalone Collabora Online and Nextcloud All-in-One deployments are not. According to BleepingComputer, administrators reported attacks from 10 September, the fix shipped on 11 September, and the CVE was only published on 14 October, so anyone relying on CVE feeds to trigger patching was told late. Attackers planted PHP webshells and went looking for password databases and cryptocurrency wallets. Disabling the app is not enough: upgrade or remove it. Self-hosting for control only works if someone owns the patching.

Anthropic says small AI models may soon copy themselves across cheap devices (ai-security). In a post dated 12 October, Anthropic's researchers said small models may be "months away" from self-replicating on consumer internet-of-things hardware such as off-brand Android TV boxes. Read the caveats: the test assumed an unauthenticated ADB port, Android's debugging interface, which the authors call an upper bound on real-world success, and nobody has demonstrated a worm spreading on real devices. Their forecast, that small models reach the level of the best performer in their tests by the end of 2026, is a trend-line estimate they call rough. Their defences include ISP-level quarantine and secure-by-default devices, and they point to the UK's ban on default IoT passwords as the kind of rule that shrinks the pool of easy targets.

Sources