An Israeli surveillance technology firm has run a large-scale operation to infect mobile phones with spyware using online advertisements to hack the devices, researchers said on Thursday.

An investigation by the University of Toronto’s Citizen Lab and cybersecurity firm Confiant Threat Intelligence laid bare an ad-based infection technique developed by an Israeli company that researchers named “AdFection.” The hacks weaponized legitimate online ad systems for espionage purposes, allowing spyware manufacturers to connect to millions of devices and identify, track and target victims.

“Plugging into the online ads ecosystem provides the mercenary spyware industry a stealthy delivery system,” said Bill Marczak, senior researcher at The Citizen Lab. He said the findings were “surely just the tip of the iceberg” of how online ads are abused for espionage.

Researchers discovered critical details of the hacking tools by analyzing devices belonging to journalists and staff at the Al Jazeera media network, finding that 45 devices of journalists and staff were targeted and some infected with Israeli-made spyware known as Candiru.

At the heart of the hacking campaign is the Israeli company Discover-Tech that describes itself as an advertising business. Citizen Lab researchers said the company facilitated surveillance for commercial spyware operators. Its platform, called Controlium, allegedly allowed spyware makers like Candiru — which in 2025 was acquired by Integrity Labs — to identify, track and target devices by loading advertisements on websites and apps.

Discover-Tech and Integrity Labs did not immediately respond to a request for comment.

The scale is striking: An analysis of four billion advertising records found that Discover-Tech’s ads appeared across nearly 200,000 websites and mobile apps in dozens of countries over four months. Among the websites that featured the ads were institutional sites of NATO, the United Nations, the European Parliament, European Commission and Council of the EU.

The technique exploits real-time bidding — the automated system used by platforms such as Google to sell advertising space and target users. Rather than persuading victims to click a malicious link, attackers can exploit advertisements to identify and potentially infect devices without any interaction from the user — a technique known as “zero-click” infections.

Discover-Tech’s advertisements directed millions of devices to servers associated with Candiru, potentially enabling large-scale surveillance and reconnaissance, researchers said. That does not mean all those devices were infected.

Citizen Lab, based in Toronto, is a globally recognized research group that previously uncovered spyware scandals targeting Catalan political figures, a member of the European Parliament and the inner circle of murdered Saudi journalist Jamal Khashoggi.

The findings triggered calls for further investigation on Thursday. “The possibility that EU institutions have been exposed should set off alarm bells across Brussels,” said Hannah Neumann, a German European Parliament lawmaker of the Greens group. Neumann herself was the victim of a cyber-espionage operation by an Iranian hacking group.

“Europe cannot claim to defend democracy while leaving its own democratic institutions vulnerable to spyware,” Neumann said.

BRUSSELS — Privacy regulators want people wearing smart glasses in public to look and sound like a truck backing down a road.

Europe’s powerful data regulators have made stringent new recommendations on how smart glasses should alert people that the wearable devices are filming, including a combination of flashing lights, audio alerts and notifications sent to the phones of people nearby.

The European Data Protection Board (EDPB), made up of national privacy regulators across Europe, issued a statement about smart glasses on Tuesday, following a meeting in Brussels.

Privacy regulators are putting forward a united front on smart glasses, as privacy concerns about the wearable technology have multiplied since videos made with them have begun spreading online without the knowledge or consent of those being filmed.

The statement is not legally binding but will guide how privacy regulators in Europe assess whether smart glasses users and manufacturers are complying with EU privacy rules like the General Data Protection Regulation (GDPR).

The regulators said smart glasses manufacturers should implement a combination of transparency measures to make other people aware that they are being recorded.

The measures may include lights or sounds when users are recording, requiring smart glasses users to activate them with an audible voice command, sending notifications to the smartphones of people nearby and other design “clues” to help people spot smart glasses.

The group of privacy regulators said that not only should users of smart glasses respect other people’s privacy but that the devices’ manufacturers and people providing connected apps or services may also be responsible for making sure they comply with privacy rules.

The GDPR applies to companies and organizations, and doesn’t apply when people process personal data in a household context. The regulators said this household exemption should be “narrowly interpreted” when it comes to smart glasses, and would not apply when someone shares photos or videos of others “to an indefinite number of persons on a public social media account.”

Tech firms like Meta have pitched their smart glasses to consumers on the basis that they are sleek and discreet. Meta has included an LED light in its smart glasses, which activates while recording, which it has said is a key privacy safeguard.

Samsung and Google have also recently announced that they’re collaborating on a new line of “intelligent eyewear” set to launch later this year, and Apple is reportedly aiming to hit the market with its own smart glasses by the end of 2027. 

The regulators’ statement could now force smart glasses manufacturers to reassess whether and how they sell smart glasses to European consumers. The EDPB called for industry-wide standards to be developed to make sure people are able to spot smart glasses and understand how they process data.

The European group of privacy regulators also commissioned a study into the social acceptability of smart glasses, published today.

BRUSSELS — The EU is facing a winter gas shortage that could leave it scrambling to replace lost energy supplies equivalent to the power used by 12 million homes, according to new reports shared with POLITICO.

The shortfall raises the prospect of a winter of soaring power bills and forced energy saving measures if the bloc fails to find adequate supplies elsewhere.

As the war in Iran continues to disrupt global energy supplies, the EU faces an overall shortfall this winter of up to 14 billion cubic meters of natural gas — around 7% of the bloc’s demand and enough to power between 10 and 12 million European households, according to a report by the Institution for Energy Economics and Financial Analysis, a U.S.-based energy think tank.

Those conclusions are echoed in a key report by a top European body of gas network operators that was presented to national energy officials on Thursday.

Natural gas is used widely to heat Europe’s buildings, power its industry and generate its electricity. But the EU’s gas reserves have fallen to their lowest level for the time of year since records began in 2011, at just above 70%, after high prices made it more attractive for traders to sell gas in the summer rather than store it for later use in the winter.

With gas prices at near-four-year highs and supply constrained due to the U.S.-Israeli war in the Middle East, Europe has limited supply options if the coming winter proves as cold as the last, IEEFA found.

While that doesn’t necessarily mean the bloc will run out of gas, it does mean there could be 7 billion fewer cubic meters of stored gas to draw upon. That could force countries to buy gas at high prices on increasingly volatile global markets, or even require consumers to cut demand if fresh supplies are unavailable.

The EU’s record-low reserves leave the bloc “with less of a buffer” against global supply disruptions, leaving it “vulnerable to price spikes,” Ana Jaller-Makarewicz, IEEFA’s lead European energy analyst, said in a statement. If countries are forced to exhaust stocks this year, that would also leave them with more to refill next year, continuing the feedback loop of low reserves and higher prices, she added.

The same risks were outlined in a 2026-2027 winter supply outlook published Thursday by the European Network of Transmission System Operators for Gas (ENTSO-G), an association of gas operators. The report warns that if imports of liquefied natural gas are limited or even “optimal” in the context of a cold winter, storage levels could fall as low as 11%, a baseline needed for strategic reserves that can’t be easily tapped into.

If countries hope to restore their reserves to 30% by the end of winter — or else face increased exposure to future cold spells — volumes equivalent to 7% of the demand will either have to be curtailed or simply withheld from consumers, ENTSO-G warns.

Part of that pressure comes from a looming EU-wide ban on long-term supply contracts for Russian LNG, due to take effect in January, which will reduce European gas imports by an additional 7 billion cubic meters, according to the IEEFA report. Russian gas has been historically used to offset “swings in demand” over the winter, it said. “Now Europe depends on storage to get through winter.”

To make matters worse, the IEEFA report argues, gas demand over winter has crept up in the past two years, while imports to the bloc have flatlined. That’s left the EU leaning harder on its reserves over the winter period, with net drawdowns rising to 22.6 billion cubic meters in January this year, up from 18.8 billion cubic meters in January 2025 and 17.8 billion cubic meters in January 2024.

The alternative would be to import fresh LNG, a seaborne fuel that the EU increasingly sources from the U.S. But at current prices, importing the lost volumes would cost Europeans an additional €3 billion, a 12% rise over what the same volume would have cost last year, on top of already sky-high prices, according to the report. U.S. LNG production is also near full capacity, meaning those additional imports would further squeeze supply, Jaller-Makarewicz told POLITICO.

To some, a rise in prices is more likely. While ENTSO-G’s tight market scenario assumes a “global deficit” that sees available LNG imports into Europe reduced by 20%, Laurent Ruseckas, a senior gas market analyst at S&P Global Energy, argues that reserves can only ever fall so low, “since a rapid drawdown early in winter will drive up prices,” drawing cargoes to Europe from Asia.

“There is not much demand to destroy in Europe,” he added, pointing out that the war in Ukraine already destroyed 20% of the bloc’s industrial demand. “And it didn’t come back.”

ATHENS — The U.S. and Greece are launching a new counterterrorism information-sharing program, U.S. Secretary of State Marco Rubio said Wednesday during an official visit to the Greek capital.

In a press conference alongside his Greek counterpart Giorgos Gerapetritis, Rubio said Greece was particularly exposed to threats posed by mass migration, human trafficking and different forms of terror.

“What we do not wish to see under any circumstances is that the birthplace of the West is threatened by bad decisions, by inaction, and by failure to address challenges,” he said, calling Greece a “strong and model NATO ally” and a “source of stability in an unstable world.”

Gerapetritis said Greece was willing to cooperate with the U.S. and provide maritime assistance in the Strait of Hormuz, ⁠if a viable peace process exists there.

Later Wednesday, Rubio will deliver a speech from Pnyx Hill, beneath the Acropolis, one of the most important sites of Athenian democracy. Assistant Secretary for Global Public Affairs Dylan Johnson said Rubio would use the opportunity to call for a “renewal of the Western spirit.”

Rubio will describe the shared inheritance of Americans and Europeans as stretching “from Athens and Rome to Christendom to the founding of the American Republic” and warn that Western civilization has forgotten some of its “essential qualities,” Rubio’s aide said.

The foreign policy chief stood by U.S. Ambassador to Greece Kimberly Guilfoyle after U.S. senators and Greek opposition parties expressed concerns over reports that she had ​threatened to use U.S. influence to topple the Greek government.

“Suffice it ⁠to ​say, our embassy here is doing a ​great job. Our ambassador has been a strong ambassador here,” Rubio said when asked whether Guilfoyle’s conduct is in compliance with State Department ethics.

Fifty European Union lawmakers, including 46 women, have been the targets of deepfake pornography, according to new research released Monday.

The number of women targeted by deepfake pornography — when generative AI is used to create sexually explicit depictions of people, often without their consent — means roughly one in six female members of the European Parliament have been affected, the report by Agora Digitale Transformation, a Germany-based civil society group, said.

The European Union is banning AI-powered nudifier apps on Dec. 2, and is also investigating similar use of Grok on the social media platform X.

A cross-party group of 119 MEPs called for effective enforcement of the ban and prompt resolution of the investigation into Grok, in a Sept. 30 letter sent to Commission President Ursula von der Leyen, the head of the Council of the EU Antonio Costa, Parliament President Roberta Metsola, EU tech chief Henna Virkkunen and Commissioner Hadja Lalhbib. The signatories included leaders of the liberal Renew, the socialists, and The Left: Iratxe Garcia Pérez, Valérie Hayer, and Manon Aubry, respectively.

“There can’t be any loopholes or delays” in enforcing the ban, Austrian Greens MEP Lena Schilling, who also signed the letter, told reporters on Monday.

Politicians can’t opt out of having their likeness online, so it’s hard for them to avoid being targeted by AI nudifiers, said Benjamin Shultz, who co-authored the report.

Shultz said that to enforce the ban, the Commission needs to hold accountable all entities that, at times, inadvertently enable the nudifier industry. That also includes payment processors and domain registrars. The report said the Commission should also look into how to get search engines to de-index AI nudifier websites, meaning removing them from their databases.