Publications

This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Candiru’s spyware. We also uncover Discover-Tech, and show how the company helps mercenary surveillance vendors track and hack devices around the world.

This is an executive summary for our report “Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware.”

Citizen Lab researchers Noura Aljizawi, Shaila Baran, Marcus Michaelsen, and Siena Anstis published a paper titled “Security Without Safety: Queering Cybersecurity in the Age of Digital Transnational Repression” in the special issue on “Digital Intersectionality and Marginalization in the Majority World” of the Journal of Online Trust and Safety.

We found that former Member of the European Parliament Stelios Kouloglou was hacked with Pegasus spyware while serving on the PEGA committee, which investigated Pegasus and other spyware abuses in Europe. Through forensic analysis of his device, we found that the attackers could have had access to confidential documents and committee deliberations.

Citizen Lab researchers Siena Anstis and Marcus Michaelsen write about the lack of accountability for perpetrators of transnational repression.