The Citizen Lab

No rest for the wicked! We have a new The Citizen Lab report out this morning, in collaboration with The Share Foundation. We are confirming the infection of the device of Serbian professor + opposition member Vladan Đokić, Rector of the University of Belgrade. We are also confirming an Apple notification received by Serbian prosecutor, Rade Bajić, who had been removed from his job investigating corruption around the building of a hotel in Belgrade by Jared Kushner and then became a prominent whistleblower. So much for using spyware to investigate "serious matters of crime and terrorism." Once again, NSO Group's services caught helping corrupt rulers wiretap the opposition. https://lnkd.in/gZh4eQP6 Interesting timing: almost simultaneous with the publication of our report, Serbian pro-regime media has begun circulating a "secret recording" of Rector Đokić. Wonder where they sourced that from 🤔 ? POLITICO Europe has a news report out on it here: https://lnkd.in/ggRvCtUw and CyberScoop does as well, here: https://lnkd.in/graDywrs. Also Reuters: https://lnkd.in/gidSwiN9 This is a big deal as Serbian elections are scheduled for later this week.

Billions of advertising auctions determine in real time which ads we see on websites and in apps every day. Our latest research shows how data from these auctions is being used to profile millions of users and silently infect targets with zero-click mercenary spyware, a novel attack technique we call "Adfection.” At the centre of this report is Discover-Tech, a company that presents itself as a legitimate online advertising business. In reality, it operates as an intermediary bridging the digital advertising ecosystem and mercenary spyware vendors (and their government customers) seeking to track individuals with spyware. Discover-Tech’s platform enables spyware firms to mass-profile and deanonymize users, then covertly hack them by sending seemingly-benign ads containing zero-click exploits to install spyware. Our research shows devices at international news network Al Jazeera were infected with mercenary spyware from Candiru (rebranded as “Integrity Labs”) via targeted online advertisements. This report presents the first public technical demonstration of in-the-wild infection of devices with zero-click mercenary spyware via targeted advertisements. Full report: https://lnkd.in/gv5dpAFR

📢 We’re hiring! Interested in the intersection of law, technology, and human rights? Are you a law student or a graduate student with a law degree? We’re looking for a research assistant to join the Citizen Lab’s spyware and digital targeted threats team. The Citizen Lab is a public-interest research group based at the Munk School of Global Affairs & Public Policy, University of Toronto, focused on investigating novel threats to democracy, human rights, and global security in the digital ecosystem. Under the supervision of the senior legal advisor, the research assistant will help maintain our spyware litigation database by monitoring developments in spyware-related legal proceedings and drafting case entries. Learn more and apply by Dec 1: https://lnkd.in/gySrQw_P

🗓️ Join senior researcher Wolfie Christl at re:publica Vienna on October 2nd to learn how government agencies are accessing behavioural data from online advertising for surveillance purposes. Register here: https://lnkd.in/dp8uHrcA

New publication 🚨 In response to a request for information from the Research Directorate at the Immigration and Refugee Board of Canada, colleagues at The Citizen Lab and I have written a submission examining the Chinese government's monitoring of Chinese citizens and diaspora members in Canada. Our submission provides an overview of the connection between state surveillance and repression in China, and Chinese state surveillance and transnational repression abroad. It also details the digital tools used against Beijing's overseas critics, and state repression of their family members in China. Long story short: surveillance and transnational repression is a severe and persistent threat to targeted Chinese citizens, diaspora members, and their families. Read our submission here: https://lnkd.in/gppdhuv6

🔈 Join Citizen Lab director Ronald Deibert in Toronto for his keynote speech at SecTor on October 7. He will be speaking about the Citizen Lab’s decades of work acting as “counterintelligence for civil society.” Register: https://lnkd.in/dVfdvVcw

Glad I will be speaking at #Disinfo2026 in Vilnius. I will discuss how generative AI enabled (and undermined) the influence operation we at The Citizen Lab called #PRISONBREAK (link to the report in comments). Come and join us! 📅 7-8 October 2026 📍 Vilnius, Lithuania 🔗 #Disinfo2026

🚨 NEW REPORT 🚨: We at The Citizen Lab analyze the covert influence ops run by the Israeli firm BlackCore on behalf of the Angolan government. We obtained access to their training documentation. Their claims are shocking - or are they? BlackCore has been exposed before. Notably, in June this year the French government accused the Israeli firm of being behind interference in elections in Scotland, New York City, African countries, and of course France. We set out to analyze the company's online presence and digital infrastructure, so to understand more about their modus operandi. The amount of publicly available information on their tactics was staggering. BlackCore positioned itself as an expert actor in the covert influence operations industry. "Influencing perceptions" on behalf of clients is one of their stated goals. But before you're tempted to ask - isn't that what strategic political communications does? Let's use their own words to answer that. On a subdomain of their website, BlackCore explicitly advertised *deception* as a service. - Dominating the discourse w/avatars? ✅ - Getting real people to engage with fakes? ✅ - Disrupting dissenting, legitimate narratives? ✅ - Are 100K to 1M monthly messages enough? ✅ But one more thing stood out. BlackCore offered training programs for clients to run their own local campaigns independently. A source gave us access to documentation from one of them: a training program and its operations supporting the government of Angola. Their proposal was pretty specific and, at times, technical. It even included modules on how to run advertisement campaigns linked to the covert IO on both Meta's platforms and TikTok. But what was even more revealing was their final report to the client. In it, BlackCore claimed to have run a continuative 14-week program including the deployment of live assets on the target platforms. It showed examples. And it boasted of its successes. You probably won't be shocked to hear that one of BlackCore's main avatars in Angola was an AI-generated middle-aged man depicted while pensively reading a tome on "ciência política". But you may be surprised by the engagement levels they were proud to show their clients. Almost 20k reactions for a single BlackCore-linked Facebook post. And: 630K views, 90% of which by non-followers of the page! Just two weeks ago, Meta released their H2 Adversarial Threat Report, which included an IO firm from Israel running the *same exact campaigns* that BlackCore was exposed for, including in Angola. Meta doesn't name the firm - but how likely is it to be a pure coincidence? Key takeaways: ☢️ IO firms are the threat we continue to underestimate. We @citizenlab.ca will keep researching them. 🌍 They are a global thing. Do not think they only are in certain countries. Remember #PAPERWALL? 🤖 AI is already making them harder to detect. Let's make AI harder for them to use. 🔗 Link in the first comment!

Ever since Apple started sending out notifications in 2021 alerting customers that have been targeted with mercenary spyware, new cases of abuse have rolled into the Citizen Lab for us to investigate. Yesterday, we published a new report in collaboration with colleagues at The SHARE Foundation after 14 Serbian protestors, a member of parliament, and a local councillor received Apple notifications warning them their phones had been targeted with spyware. Our forensic analysis shows that the iPhone of one of those student protestors was infected with a zero-click version of NSO Group’s Pegasus spyware across December 2025 to January 2026.  The exploit used in this attack was patched by Apple as of iOS 18.4.1. We are not disclosing the name of the victim at their request. The Serbian student protest movement emerged in November 2024, and has grown into waves of protest and civil disobedience against the corruption of Serbia’s current government led by President Aleksandar Vučić. Vučić’s regime has responded with repression and propaganda, including the use of excessive force and arrests, and media campaigns aiming to discredit the opposition. Our latest investigation with The Share Foundation shows that the regime is also apparently willing to do what an unfortunately large number of illiberal regimes are doing: hacking into the phones of peaceful political opposition movements to snoop on them. This case shows yet again the value of tech companies sending out notifications. Apple’s latest round of notifications (that included the Serbian protestors) is the largest of them so far, and includes victims in more than 100 countries. Stay tuned for more! Citizen Lab report here: https://lnkd.in/gABKqAeg The Share Foundation’s report: https://lnkd.in/gH6jR45r Financial Times: https://lnkd.in/gbk_JFzF Reuters: https://lnkd.in/gGVwveiZ The Guardian: https://lnkd.in/gpUe8nSK Cyberscoop: https://lnkd.in/gzrsnaj9 LeMonde: https://lnkd.in/gdnfEUqp Bloomberg: https://lnkd.in/gi6Pk8_n

I am psyched to be giving the keynote to Black Hat SecTor 2026 in Toronto "On Counterintelligence for Civil Society." See you there! https://lnkd.in/g7T8nV25