Counterintelligence for civil society

Investigating novel threats to democracy, human rights, and global security in the digital ecosystem.

Exposing AdFection

How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware

Targeted Surveillance

This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Candiru’s spyware. We also uncover Discover-Tech, and show how the company helps mercenary surveillance vendors track and hack devices around the world.

October 15, 2026

BlackCore’s Influence Operations for Hire

Disinformation

In this research note, we examine the digital infrastructure of BlackCore, an Israeli influence-for-hire company. We describe how we identified a BlackCore campaign consisting of a training program provided to government employees in Angola, including the launch of a supervised influence operation.

September 17, 2026

Pegasus Spyware Infection of Serbian Pro-Democracy Student Activist

Targeted Surveillance

In collaboration with the SHARE Foundation, the Citizen Lab confirmed that the iPhone of a member of Serbia’s student protest movement was infected with Pegasus spyware.

September 2, 2026

Counterintelligence for civil society

Investigating novel threats to democracy, human rights, and global security in the digital ecosystem.

Counterintelligence for civil society

Investigating novel threats to democracy, human rights, and global security in the digital ecosystem.

Exposing AdFection

How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware

Targeted Surveillance

This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Candiru’s spyware. We also uncover Discover-Tech, and show how the company helps mercenary surveillance vendors track and hack devices around the world.

October 15, 2026

Read the full report

BlackCore’s Influence Operations for Hire

Disinformation

In this research note, we examine the digital infrastructure of BlackCore, an Israeli influence-for-hire company. We describe how we identified a BlackCore campaign consisting of a training program provided to government employees in Angola, including the launch of a supervised influence operation.

September 17, 2026

Read the full report

Pegasus Spyware Infection of Serbian Pro-Democracy Student Activist

Targeted Surveillance

In collaboration with the SHARE Foundation, the Citizen Lab confirmed that the iPhone of a member of Serbia’s student protest movement was infected with Pegasus spyware.

September 2, 2026

Read the full report

The Citizen Lab is an interdisciplinary research unit at the Munk School of Global Affairs & Public Policy, University of Toronto. We apply our collective expertise in the fields of law, computer science, cybersecurity, political science, and social sciences to investigate complex issues of the 21st century.

learn more about us

Explore focus areas

App Security & Privacy
Artificial Intelligence
Censorship
Digital Transnational Repression
Disinformation
Law & Policy
Mass Surveillance
Targeted Surveillance

Get the latest research in your inbox.

SUBSCRIBE

Recent news

see all news + updates