Mercenary spyware is surveillance software that a private company builds and sells, usually to governments, to take over a person's phone or computer in secret. Once installed, it can read messages, take files and steal passwords for the buyer. It is also called commercial spyware.
- Also Called1other nameCommercial spyware
- Related Terms3linked entriesZero-day vulnerability · Malvertising · Exploit kit
How does it work?
The seller gives the buyer a way to infect one chosen person. Older methods sent a link that the target had to open. Newer methods need no click at all, and often use zero-day vulnerabilities in phones, browsers or the operating system.
In 2026 the Citizen Lab described attacks where a targeted online ad was enough (Citizen Lab executive summary). Its report on the AdFection attacks through online ads says the buyer picked one person by advertising ID, cookie or IP address. When the ad showed, code ran that could load a browser exploit.
What does it take from a device?
The Citizen Lab’s 2021 study of Windows spyware made by Candiru is a good example. That spyware could:
- take files from the computer
- export messages from the Windows version of Signal
- steal cookies and saved passwords from browsers
- send messages from email and social media accounts that were logged in
See the Candiru spyware profile for its names, timeline and defences.
Why does it matter?
The targets are often journalists, activists, officials and business leaders. In November 2021 the US Commerce Department put two Israeli spyware makers on its Entity List. Its Bureau of Industry and Security notice said they supplied spyware to foreign governments that used it against officials, journalists, businesspeople, activists, academics and embassy workers. The Predator spyware attempts in Egypt show the same pattern against a politician.
How do you defend against it?
- Install phone and browser updates the day they ship.
- Block ads at the network gateway and on work devices.
- Turn off unique advertising IDs on managed phones.
- Give staff who are likely targets a clear place to report odd messages or device behaviour.
Brandefense Executive Protection watches for threats aimed at the people most likely to be singled out.
Also Called.
- NameCommercial spyware
Questions.
-
Who buys mercenary spyware?
Mostly governments. The Citizen Lab says Candiru sells only to governments, and the US Commerce Department said Candiru supplied spyware to foreign governments.
-
Can it infect a device without a click?
Yes. The Citizen Lab's October 2026 report says showing a targeted online ad was enough to infect devices in the AdFection attacks.
-
Is it legal to sell?
Rules differ by country. The US put Candiru and another spyware maker on its Entity List in 2021, which restricts US exports to them.
Sources
- 1 Exposing AdFection Executive Summary (15 October 2026), The Citizen Lab
- 2 Hooking Candiru: Another Mercenary Spyware Vendor Comes into Focus (15 July 2021), The Citizen Lab
- 3 Commerce Adds NSO Group and Other Foreign Companies to Entity List for Malicious Cyber Activities (4 November 2021), US Bureau of Industry and Security
- 4 Addition of Certain Entities to the Entity List (2021-24123), Federal Register, US Department of Commerce