Zero-click attacks used targeted ads to deliver Candiru spyware
Candiru spyware was delivered to devices at Al Jazeera Media Network via targeted online advertisements in a zero-click attack that required only rendering the malicious ads on the victim's device.
Excerpt from the primary source: BleepingComputer
Who is affected
Security professionals
What you should do · Be aware
No immediate action is indicated. Share this with the relevant teams and watch for updates.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Original reporting
Related
In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit
Noteworthy stories that might have slipped under the radar: BofA adds 1,000 patching contractors, KGB RAT pairs data theft with jump scares, and Langflow flaw under attack.
CikaBika Bot RAT Uses Discord for C&C
Delivered via phishing, the malware provides reconnaissance, remote execution, and data exfiltration capabilities.
Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies
The Hirudo malware combines elements of a traditional banking trojan and a full-featured RAT.
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
We investigated an intrusion where attackers exploited CVE-2024-47575 to target 500+ firewalls and deploy PEERSTITCH, a memory-resident ARM64 malware.
CISA lists this as exploited in the wild. Unpatched FortiGate / FortiOS systems are exposed to active attacks now.
Treat this as an emergency.