Researchers say that mercenary hackers laced ads with zero-click exploits that installed sophisticated malware on the devices of targeted individuals when they did nothing other than load a website or open an installed app.
The finding, published Thursday by the University of Toronto’s Citizen Lab, said the incident is likely to be the first confirmation of zero-click mercenary spyware delivered through targeted ads. The attacks, which worked on iOS and Android devices, are particularly pernicious because they work without requiring any interaction from the target and are invisible unless users run special forensic hardware or software. Citizen Lab said it confirmed that AdFection, as it named the campaign, infected 45 devices at international media organization Al Jazeera in 2024 and 2025.
A clear warning signal
“This investigation should … serve as a clear warning signal to news organizations around the world that they may be being actively targeted via this new threat,” Citizen Lab researchers wrote. “This targeting may happen both in newsrooms and to individual journalists, editors, and other staff members.” Their report went on to say: “The distribution of spyware via targeted ads represents a security risk not only for potential victims but also for states and civil society at large.”
The ads were provided by Discover-Tech, an Israeli company that brands itself as a legitimate advertising company, but Citizen Lab said it operates as a facilitator for multiple mercenary spyware partners. The company acts as a broker between parties that want to display their ads and publishers or app makers that seek revenue in return for showing them. In this capacity, Discover-Tech acts as a “bridge between ad vendors and the mercenary spyware ecosystem,” a role that appears to be “Discover-Tech’s primary purpose,” Citizen Lab said.
The brokering involves a bidding process in which advertisers offer a fee in exchange for their ads appearing on the devices of individuals in particular demographics. Using users’ unique mobile ID, location, IP address, and other breadcrumbs, the brokers are able to assemble detailed profiles of millions of people. Citizen Lab said it obtained more than 4 billion bidding records handled by Discover-Tech. They revealed that Discover-Tech ads were displayed in over 70,000 mobile apps and more than 120,000 websites between March and June 2026.
Among the major vendors that listed Discover-Tech as a “certified” or “verified” vendor were Google and the advertising industry association IAB Europe. The Israeli firm also used European General Data Protection Regulation (GDPR) consent frameworks to target users within the European Union. Discover-Tech has served ads through major networks such as Google, Yandex, and Beeswax.
Google and IAB Europe have since removed Discover-Tech from their ad vendor registries, and Google further terminated Discover-Tech’s access to its ad exchange platforms. Beeswax has removed Discover-Tech from its ad buying platform. Fellow ad platform Vungle (Liftoff) paused Discover-Tech’s access while conducting a review, and Eskimi blocked Discover-Tech’s accounts and domains.
Thursday’s report said that Discover-Tech ad impressions have appeared on government and national-security-linked networks throughout the world: NATO, United Nations networks, European lawmaking bodies, critical infrastructure providers in Australia, and armed forces and government agencies in Norway and Sweden.
“Discover-Tech’s mass abuse, privacy invasion, and facilitation for mercenary spyware attacks illustrates structural flaws with the online advertising system, which failed to detect or prevent the abuse documented in this report,” Citizen Lab said.
The research lab said that the mercenary malware installed through AdFection was developed and distributed by Candiru (rebranded as “Integrity Labs”). Under the arrangement with Discover-Tech, targets with specific profiles of interest to the Candiru customers received ads that carried JavaScript or other code that connected to Candiru’s control servers. In response, those servers delivered an exploit that served the zero-click payload when the ad appeared on an individual’s device.
The research doesn’t describe the vulnerabilities exploited in the zero-click attacks or the final malware that was installed in them. It’s likely they were zero-days that have been fixed after Citizen Lab discovered the campaign. Citizen Lab didn’t immediately respond to questions.
Messages sent to Discover-Tech and Candiru went unanswered.
Citizen Lab called on advertisers and government officials to take concrete action to proactively prevent campaigns like AdFection. Beyond that, users can reduce the risk of being infected by installing ad blockers, resetting mobile advertising ID in iOS and Android settings (it’s unclear why the researchers didn’t advise turning off personalized ads altogether), and installing ad-blocking software on home or office networks. As always, installing updates in a timely manner is also a must.

When Federal Reserve Chairman Kevin Warsh strides onstage in Bangkok on Friday morning, it will be after 11 p.m. on Thursday in New York. But investors, economists and politicians in the United States will be awake and hanging on his every word.
Any speech by a Fed chair is closely scrutinized. This week’s talk has an extra dose of urgency, though, after two government reports showed inflation heating up for consumers and businesses — spurring speculation about how soon the Fed will raise interest rates to handle soaring prices.
Warsh will be speaking at the annual meeting of the International Monetary Fund and the World Bank, where he will be interviewed by IMF Managing Director Kristalina Georgieva. The Fed chairman has repeatedly said he will not use public speaking engagements to intentionally steer the expectations of investors and markets, but his comments could nevertheless signal whether the central bank will hike rates before, or after, the Nov. 3 midterm elections.
It will also be the last speech from a Fed official before policymakers enter a “blackout” period on Saturday that lasts through their next interest rate meeting, which is scheduled for Oct. 27 and 28.
“Broad based” inflation “strengthens the case for an October hike,” Bank of America analysts wrote on Wednesday. “The data continue to underscore two key sources of inflation pressure: AI and Iran.”
Those two factors aren’t likely to be going anywhere soon, either.
The price of politics
Already hammered by soaring interest rates, rising energy prices and stagnant wage growth, American consumers could get an extra dose of financial strain if the Fed raises rates again this month.
Voters are already dissatisfied with President Donald Trump’s handling of the economy, polls show, so another rate hike could add to Republicans’ headaches as they face potentially losing their congressional majorities in the midterms.
In recent weeks, Trump has tried to pull multiple policy levers to lower gas and diesel prices, which have pushed inflation higher in recent months. But none of them have yet slowed prices meaningfully.
“Starting on day one, we will end inflation and make America affordable again,” Trump said on the campaign trail in 2024. Inflation as measured by the consumer price index declined to as low as 2.3% four months into Trump’s term.
But that same month, Trump unleashed a wave of tariffs across the globe, dramatically changing the economic story.
By September, inflation breached the 3% threshold again. In February, Trump launched the war against Iran, causing one of the worst energy supply shocks in history. Inflation jumped as high as 4.1% in May, and looks to be headed back in that direction again.
Another Fed rate hike would also further undermine Trump’s yearslong pressure campaign to push the central bank to cut rates. Since Warsh took his post in May, the central bank has either held rates steady or increased them.
Trump hasn’t attacked Warsh after years of hammering former Chair Jerome Powell. But the president has started saying that the other members of the Fed’s board are “very hostile.”
“I’m relying on Kevin,” Trump told reporters in September, “but he’s got, you know, a very tough board. He’s got a board that was put there by a lot of other people, and the interest rates are too high.”
“They’re very political,” Trump said. Four of the Fed’s seven board members were appointed by Trump.
Asked what the president’s expectations are for Warsh’s appearance, the White House pointed to a Truth Social post from September in which Trump had written, “Interest rates in the United States should be 1% or less.”
Diesel and the damage done
Economists and investors are paying close attention to so-called core inflation, which excludes volatile food and energy prices. Both reports this week showed that even this adjusted measure of price growth is running hotter than hoped for.
“Core CPI was the more significant surprise,” wrote analysts at Bank of America.
The core readings showed that skyrocketing fuel prices, particularly diesel, are trickling down. Farmers, truckers and others who keep commerce humming in the United States have to raise their prices in order to digest higher diesel costs. That, in turn, leads to price increases for consumer goods.
“The cost of diesel gets into just about everything,” KPMG chief economist Diane Swonk told NBC News in an August interview. “Everything from … running a farm … cost of food, but also everything across the economy that’s shipped gets that extra fee tacked onto it.” At the time, she described the surge in diesel fuel prices as likely “an inflationary problem for the next several months.”
Her warning came to fruition in September, according to the consumer price index and producer price index reports this week. With diesel prices remaining solidly above $6 per gallon so far in October, and with no sign that the Iran war is near an end or that attacks on energy assets in the Ukraine-Russia war will be paused, it could keep fueling overall inflation for months.
Big Tech is also fueling inflation. Trillion-dollar companies are spending, and borrowing, big sums for servers, memory and other components that will be used in data centers. That’s caused price spikes across the economy.
Companies including Apple and Nintendo have raised prices as a result. “We have never seen a component price increase this much, this quickly,” Apple told NBC News in June.
Companies are also tapping the public debt markets in an unprecedented way. Data center companies and associated utility firms, chipmakers and cloud providers are expected to raise between $300 billion and $570 billion from the debt market this year, according to Vanguard. Those firms are also offering highly attractive interest rates, sometimes better than U.S. Treasury bonds.
A consequence of that, Warsh noted recently, is that there’s a “competition for capital” driving up interest rates on government debt, too.
“This is a complicated set of things that are affecting the most important asset anywhere in the world, the 10-year Treasury,” Warsh said. “It’s the risk-free asset upon which every price of virtually every asset in the world is related to.”
Without referencing the Iran war, he also said yields were being driven by “geopolitics” and the strength of the economy.

Meta has launched what it calls the “most capable” open-weight model in the United States. Dubbed Muse Spark Open, the model also has the distinction of having been designed to work with Macs.
The new model, which leverages 816 billion parameters and a 1 million token context window, claims to offer superior performance to other popular open-weight models, according to evaluation results released by Meta on Thursday.
Muse Spark Open is natively multimodal and built for complex coding tasks and agentic labor. It has also been designed to run locally on Apple’s computers. However, you will still need a lot of power to run the model locally, with a requirement of at least 1 terabyte of RAM, per Engadget. The model will run best via the Mac Studio that comes equipped with the M5 Ultra chip.
Still, if you can muster the memory, Muse Spark Open may prove a significant work horse for coding and other desktop tasks. Meta says that it paired the model with Muse Code, its AI coding terminal, and deployed it to various agentic workflows, including coding fixes for a Mastodon client that included “bug fixes, new features, [and] full build.”
The company says it also deployed it in the service of running DaVinci Resolve, the high-end video editing software, revealing that the model was capable of reviewing and cropping footage.
Open-weight models provide a number of distinct industry advantages that aren’t afforded by closed and proprietary models. Open-weight models can be significantly more cost-efficient and can also offer transparency and flexibility that closed source models don’t allow.
Meta is making the new model available now through a number of different API platforms.

U.S. health officials are moving ahead with a plan to allow specialty pharmacies to produce certain peptides, a class of largely unregulated injections that have become popular among followers of Health Secretary Robert F. Kennedy Jr. and other wellness influencers.
Kennedy’s Department of Health and Human Services submitted a peptides “interim access policy” to the White House for review, according to a posting Thursday on a government website. The plan was sent to the Office of Management and Budget, which reviews federal rules and regulations with the potential for significant economic impact.
HHS officials did not immediately respond to requests for comment Thursday afternoon.
Peptides are the building blocks of more complex proteins, triggering hormones inside the body needed for growth, metabolism and healing. Drug companies have brought several to market as medications, including mainstay treatments for diabetes and weight loss.
But the ones at issue here haven’t gone through that rigorous vetting process. Nevertheless, they have gained a foothold among Americans interested in bulking up, looking younger or boosting energy. Those uses are not approved by the Food and Drug Administration and most of the data on peptides comes from animal studies.
Before joining the administration, Kennedy publicly declared that “FDA’s war” on peptides and other wellness products would soon end.
After becoming health secretary, Kennedy said U.S. compounding pharmacies must be allowed to sell peptides because Americans were increasingly turning to “gray market” peptides made in China and other countries. Those products remain widely available for purchase via online platforms like TikTok.
The White House filing doesn’t give specifics of the new policy, but two people familiar with the plan say it is intended to allow pharmacies to temporarily compound some of the most popular peptides, including BPC-157, a chemical promoted to build muscle and heal injuries. The people spoke on condition of anonymity to discuss confidential government deliberations.
The update is the latest indication that Kennedy and other Trump administration officials are looking to ease access to unproven products that are popular within the Make America Healthy Again movement. Some of the biggest MAHA figures sell peptide injections and supplements.
The FDA previously placed BPC-157 and more than a dozen other injectable peptides on its list of substances that are too risky to be compounded by pharmacies. Possible risks include contamination, allergic reactions and tumor growth, according to the FDA.
But earlier this year, Kennedy directed the agency to reconsider a short list of chemicals that have been widely promoted by wellness influencers and fitness celebrities.
In July, a panel of external FDA advisers recommended the agency drop its restrictions on six of the seven peptides put before them. That recommendation went against the scientific conclusion of FDA’s staff scientists, who reiterated that none of the peptides had been studied enough to establish their safety and effectiveness.
The new policy sent to the White House would essentially assure compounding pharmacies — specialty businesses that mix customized medications that aren’t available from traditional drugmakers — that they won’t be targeted for producing certain peptides, according to the people familiar with the plan. That approach, known as enforcement discretion, allows the FDA to selectively choose to not enforce some of its own regulations.
Formally adding the peptides to FDA’s list of drugs that are safe for compounding would require federal rulemaking, a process that could take years and involves multiple rounds of public comment. It was not immediately clear if the administration still plans to pursue that process.
The proposal was quickly praised online by some Kennedy allies who sell peptides.
“This is huge,” Brigham Buhler, a wellness clinic operator who sells peptides through an online service, posted on X. “This isn’t about whether you’re for or against peptides. It’s about whether you’re for or against MEDICAL FREEDOM.”
The panel of outside experts that met in July was selected by Kennedy’s health department and included several doctors, pharmacists and consultants who work in the peptide field.

Harvard University’s endowment grew 27.1% in fiscal year 2026, its strongest return in five years, the school said in its annual financial report released on Thursday.
The endowment, which beat the S&P 500’s 22.3% total return in the same period by 4.8 percentage points, now totals nearly $68 billion. The outperformance came amid actions by the Trump administration to penalize the school and withhold funding from the university.
“While markets can easily take back what they give, that return will strengthen the endowment’s capacity to support the University over time,” Harvard’s chief financial officer Ritu Kalra and treasurer Timothy Barakett wrote in the 49-page annual report. “The University deliberately smooths distributions so that operating support does not rise and fall with the markets. Strong investment returns therefore support Harvard’s work gradually, through future distributions.”
The returns marked the best year for the endowment, managed by the Harvard Management Company, since 2021. Harvard’s fiscal year ends on June 30.
In its second-quarter 13F filing with the Securities and Exchange Commission, Harvard unveiled a $2.2 billion stake in Elon Musk’s SpaceX rocket and satellite company. It marked the endowment’s largest single holding by value, trailed by Taiwan Semiconductor Manufacturing Company at just under $350 million.
Harvard’s financial picture, though, is undermined by moves by the federal government. Federally-sponsored research revenue declined 19.5% to $509 million in fiscal 2026.
And starting in the current fiscal year, “endowment resources will face an additional constraint, with the federal excise tax on Harvard’s net investment income rising nearly six-fold, from 1.4% to 8%,” Kalra and Barakett wrote. “We estimate the higher rate will cost roughly $300 million a year.”
“[I]n a year of returns like this one,” the federal excise tax “would be several times larger,” they noted.
President Alan Garber acknowledged such headwinds, but said in the report that Harvard can still succeed.
“Together, we have the opportunity to set the University on a path to excellence that none of us can imagine today,” he said. “Notwithstanding the challenges and uncertainty, this is a thrilling time to be part of a great American institution devoted to Veritas.”