Citizen Lab said Discover-Tech's ads delivered zero-click Candiru attacks to at least 45 Al Jazeera devices. Google and IAB Europe have delisted the vendor, but Citizen Lab cannot yet attribute the attacks to any party.
Perspective Coverage
14 publishers
- Builder
- Builder 22%
- Operator
- Operator 51%
- Investor
- Investor 27%
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+15
- Incentives35
- Confidence76
Citizen Lab says ads from Israeli firm DiscoverTech delivered no-click spyware to at least 45 Al Jazeera devices in 2024 and 2025. Wired reports that, by Citizen Lab's account, individuals can do little beyond blocking ads as thoroughly as possible.
Perspective Coverage
16 publishers
- Builder
- Builder 16%
- Operator
- Operator 69%
- Investor
- Investor 15%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence74
NSO held sole control of the Pegasus infection module in Poland, prosecutors say
Poland's National Prosecutor's Office says the Central Anti-Corruption Bureau, which ran Pegasus, lacked full control of a system NSO Group operated. Investigators say NSO had technical access to harvested data but cannot say whether it obtained specific material.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+30
- Incentives60
- Confidence55
Paragon relies on outsiders to catch misuse of its Graphite spyware
Paragon CEO Andrew Boyd says the spyware maker cannot see whom its customers target, and that halting updates leaves their systems ineffective in about 12 hours. Its promise to drop abusive customers therefore waits on outsiders finding the abuse first.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+45
- Incentives70
- Confidence60
Paragon CEO Andrew Boyd says withholding updates is how the spyware maker cuts off abusers
Paragon CEO Andrew Boyd says the spyware maker can't see who customers target, and withheld updates leave a customer's system ineffective in about 12 hours. Its zero-tolerance misuse policy depends on outside researchers to find abuse before that slow cutoff comes into play.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+45
- Incentives65
- Confidence55
Apple's latest mercenary spyware notifications went to users in 110 countries. The response checklist is per-person, and a standard MDM baseline covers almost none of it.
Perspective Coverage
4 publishers
- Builder
- Builder 16%
- Operator
- Operator 79%
- Investor
- Investor 5%
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence65
Apple told TechCrunch it warned selected users across 110 countries on Thursday. For any org with journalists, diplomats or executives on iOS, the hardened profile is no longer an edge case.
Perspective Coverage
3 publishers
- Builder
- Builder 12%
- Operator
- Operator 75%
- Investor
- Investor 13%
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+10
- Incentives50
- Confidence68
Access Now says helpline requests ran 30% to 40% above the usual post-notification surge, a record. Among the recipients: a Ukrainian soldier who assumed the alert was a scam.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+25
- Incentives35
- Confidence60
Google's threat intelligence team ties three suspected Russian clusters to abuse of Google OAuth, app passwords and device linking. MFA completes normally, so consent telemetry is the control.
Reality
- Evidence62
- Adoption30
- Hype gap+15
- Incentives
- Not scored
- Confidence58
SHARE Foundation, Citizen Lab and Amnesty confirmed three infections among at least 14 Serbian targets around the March local elections, and the Android half of the wave was installed by hand during police custody.
Perspective Coverage
7 publishers
- Builder
- Builder 20%
- Operator
- Operator 66%
- Investor
- Investor 14%
Reality
- Evidence72
- Adoption30
- Hype gap+15
- Incentives45
- Confidence70
Gen Digital found the chain while working a live UNC3569 intrusion. Tencent's April 2026 fix closed the link handler and left the bundled Chromium 80 in place, with its sandbox still switched off in the code.
Perspective Coverage
3 publishers
- Builder
- Builder 40%
- Operator
- Operator 50%
- Investor
- Investor 10%
Reality
- Evidence68
- Adoption72
- Hype gap+20
- Incentives40
- Confidence70
Citizen Lab documents a 14-week fake-persona curriculum delivered to Angolan officials
Files obtained by the researchers show BlackCore grading more than 40 pieces of content produced by its trainees. The contractor's final report to the client claims deceptive Facebook posts approaching 50,000 likes in a country with six million active Facebook users.
Reality
- Evidence64
- Adoption52
- Hype gap+22
- Incentives74
- Confidence61
Google shipped a prompt box into the satellite tool investigators are trained on
The generative feature inside Google Earth lasted about a day before the outcry pulled it, but the verification checklists that name Google Earth as ground truth were written for a product nobody could prompt.
Reality
- Evidence56
- Adoption28
- Hype gap+18
- Incentives62
- Confidence52
Twenty-nine MEPs ask the Commission to slow Serbia's accession over Pegasus and NoviSpy findings
A letter signed Friday turns device forensics on Serbian student activists into an enlargement demand, though the signatory who spoke to CyberScoop says spyware will not be the deciding factor if Brussels moves.
Reality
- Evidence58
- Adoption22
- Hype gap+32
- Incentives68
- Confidence55
buildOne report1 publisher Three Russian clusters phish the grant, not the password, and MFA completion changes nothing
Google's threat intel group ties UNC6293, UNC7005 and UNC5976 to attacks on OAuth consent, app passwords, device codes and WhatsApp linking. The login succeeds; the token leaves anyway.
Reality
- Evidence64
- Adoption58
- Hype gap+14
- Incentives57
- Confidence55
Russia-linked crew keeps winning with app passwords and device codes
Google's threat group says UNC6293 gets targets to create the credential themselves. Detection content written against its lures ages in weeks. Switching the features off does not.
Reality
- Evidence72
- Adoption45
- Hype gap+5
- Incentives62
- Confidence58