Spyware Ads Don’t Need You to Click
A nightmare scenario has officially arrived: zero-click spyware delivered through targeted online ads. Dubbed AdFection, the technique infects your device just by loading an ad—no clicking required. A new report links Israeli ad firm Discover-Tech’s infrastructure to Candiru’s mercenary spyware.
At least 45 Al Jazeera Windows devices were targeted in 2024 and 2025. The dragnet was vastly wider, silently loading ads across 70,000 mobile apps and 120,000 websites. While an ad impression doesn’t guarantee infection, the exposure footprint is staggering.
Discover-Tech sat comfortably on Google’s and IAB Europe’s approved vendor lists for years before getting booted this week. So much for rigorous vetting.
Researchers advise using trusted ad blockers, disabling ad tracking, and resetting mobile advertising IDs. Organizations should block ads at network gateways.
Apparently, “don’t click suspicious links” desperately needs a sequel.
Microsoft Hits a Billion-Message Phishing Network
Microsoft and Health-ISAC just disrupted phishing infrastructure that fueled over 1 billion malicious messages targeting 75,000 organizations since January.
Armed with a federal court order, the partners seized domains propping up YAM Store, CoGUI, and Iron Man, while Microsoft nuked over 20,000 YAM-linked accounts.
This criminal bazaar bundled cloud access with ready-made scams. Hustlers scooped up expired school and nonprofit domains, resurrected the websites, and used that wholesome cover to fraudulently acquire Microsoft 365 accounts for resale. Yes, your fake unpaid toll bill had a corporate supply chain.
This takedown doesn’t automatically secure exposed environments. Microsoft urges defenders to deploy passkeys, audit Defender for Office 365 settings, and actively hunt for anomalous sign-ins to terminate compromised sessions.
Even phishing has a procurement department.
SAP Vulnerability Opens Door to System Takeover
SAP patched a S/4HANA flaw that could allow privileged users to execute arbitrary code and take control of affected systems.
A separate vulnerability, CVE-2026-58249, could let unauthenticated attackers crash SAP services with HTTP/2 enabled.
It’s worth reinforcing that vulnerability prioritization should be driven by actual exposure and material business impact, not CVSS scores alone.
Audit SAP Fiori permissions, assess HTTP/2 exposure, and prioritize patching affected systems based on business risk.
Microsoft Disrupts Phishing Network Behind 1B Messages
Microsoft disrupted a phishing network linked to over 1 billion malicious messages targeting 75,000 organizations across 150 countries.
The operation seized domains used to distribute compromised cloud accounts, phishing kits, and impersonation tools.
Use intelligence from the takedown to identify lingering compromises rather than assuming the disruption eliminates the threat.
Review related threat indicators, investigate suspicious cloud account activity, and revoke compromised sessions.
13.7M Records Found in Unsecured Database
A researcher uncovered 13.7 million exposed records containing sensitive information in a database.
Although access has since been restricted, it’s unclear where the records originated or whether they were downloaded.
Restricting access stops further exposure, but the risk remains unclear without knowing who could have accessed the data.
Review access logs, investigate potential data exfiltration, and assess whether exposed credentials remain active.
OpenAI Engineer Arrested in Spying Case
Authorities arrested an OpenAI engineer accused of planting a hidden recorder in an executive conference room.
Prosecutors allege he also used AI to research building the device, but whether it recorded any conversations remains unclear.
AI’s role on both sides is interesting, but a routine security sweep reportedly uncovered the device. It’s a reminder that physical security deserves the same attention as network security.
Conduct regular security sweeps of sensitive meeting rooms, restrict access, and investigate unauthorized devices.
South Korea Breaches Expose 100K Records
South Korean regulators confirmed breaches at 16 financial firms, exposing roughly 100,000 personal records.
A broader review of 555 firms found 130 security gaps, including outdated software and inadequate monitoring.
The inadequate monitoring makes me wonder: How many threats will go undetected until another major breach occurs?
Identify monitoring blind spots, verify alert coverage, and investigate suspicious activity.
Is Your Data Safe From Insiders?
Insider threats extend beyond malicious employees to include accidental data exposure, negligent behavior, and misuse of privileged access.
How to reduce your insider threat risk:
- Enforce least privilege, regularly audit permissions, and remove unnecessary access.
- Monitor suspicious activity and use DLP tools to detect and block unauthorized data transfers.
- Strengthen offboarding by immediately revoking access, terminating sessions, and recovering devices.
The effectiveness of an insider threat program should be measured by how quickly security teams detect and contain risky behavior, not by the volume of alerts generated.