> InfoSec News Nuggets – 10/16/2026

Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads Researchers at the University of Toronto’s Citizen Lab say Israeli mercenary spyware vendor Candiru infected devices at news network Al Jazeera through ordinary online ads that required no click or user interaction, marking the first public technical confirmation that government-grade spyware has reached real devices via targeted advertising. The ads, placed by Israeli firm Discover-Tech, carried a small callback that sent a device’s advertising ID and IP address to a server that decided whether to return attack code, leaving the ad networks that delivered them with nothing malicious to detect. At least 45 Al Jazeera devices were targeted in 2024 and 2025, and Discover-Tech’s ads reached roughly 75,000 apps and 120,000 websites, including networks belonging to NATO, the United Nations and EU bodies. Google and IAB Europe have since removed Discover-Tech from their approved vendor lists, and indicators of compromise have been published so defenders can hunt for the activity.   CISA Warns of Hackers Exploiting Ivanti Connect Secure Zero-Day to Steal Credentials CISA is urging administrators to patch Ivanti Connect Secure appliances after attackers exploited CVE-2026-104935, a zero-day enabling remote authentication bypass and command execution, and added the flaw to its Known Exploited Vulnerabilities catalog on October 13. Volexity traced exploitation by a threat actor tracked as UTA0576 back to October 3, when the group chained an authentication bypass, a file upload weakness and a separate privilege escalation bug to gain root on a fully patched appliance, then harvested domain credentials, queried Active Directory and hunted for local administrator passwords and BitLocker recovery keys. Because the malicious commands ran in memory and selected log entries were scrubbed, Ivanti’s Integrity Checker Tool may miss signs of compromise, so CISA recommends factory resets, rebuilding cloud and virtual appliances, and resetting stored passwords, certificates and API keys rather than relying on the patch alone.   Stolen AI API keys are paying for hackers’ autonomous scans Bitsight’s threat intelligence team found a seller on a restricted criminal forum marketing MONST3R-AI, an autonomous penetration testing panel that runs on stolen OpenAI, Anthropic and Google API keys so the organization whose key was leaked ends up paying for the scans. Across 16 underground forums from February through August 2026, mentions of AI agents, indirect prompt injection and the Model Context Protocol rose 67 percent while ransomware chatter fell by about half, with skilled actors increasingly turning to open-weights models they can run on rented servers without provider oversight. Researchers also flagged the FakeGit campaign, in which roughly 7,600 fraudulent GitHub repositories spread SmartLoader malware, more than 800 of them disguised as AI skills or MCP servers. Organizations are advised to treat leaked AI provider keys as seriously as exposed cloud credentials and to verify the source of every agent plugin they install.   Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach Meta is notifying roughly 1,500 people, most of them US employees, that their personal information was exposed after an outside group used an employee’s stolen credentials to access some of the company’s GitHub repositories. Meta says 99 percent of the stolen material was business data in the form of product source code, while the remaining 1 percent was personal data that had been placed in the repositories in violation of company policy, and much of what looked like personal data was actually synthetic or anonymized test data. The company shut down the intruders’ access, brought in GitHub and law enforcement, rotated secrets found in the repositories and is adding proactive scanning to keep user data off the platform, while affected individuals are being offered credit and dark web monitoring.   Ledger says hardware implant in cryptocurrency wallets stole recovery phrases Cryptocurrency wallet maker Ledger says devices sold through Southeast Asian reseller CryptoBilis contained hidden hardware implants that read the screen during setup, captured users’ 24-word recovery phrases and transmitted them over LTE using an embedded eSIM, allowing attackers to drain victims’ funds on October 9. Because the implants leave the device’s Secure Element intact, tampered units may still pass Ledger’s authenticity checks, and the company is also reviewing reports of implants in other signers and locations. Ledger is urging CryptoBilis customers not to set up unused devices, to move funds on affected signers to a new wallet with a new recovery phrase, and to contact support and local law enforcement before opening or shipping devices, while CryptoBilis has paused all Ledger sales and shipments. The post InfoSec News Nuggets – 10/16/2026 appeared first on AboutDFIR - The Definitive Compendium Project.