Full Report
Candiru spyware was delivered to devices at Al Jazeera Media Network via targeted online advertisements in a zero-click attack that required only rendering the malicious ads on the victim's device. [...]
Analysis Summary
# Tool/Technique: Candiru Spyware Delivery via Targeted Ads (AdFection)
## Overview
Candiru is an Israeli commercial spyware vendor that sells surveillance tools, reportedly only to governments. In this campaign, Citizen Lab tracked a zero-click infection chain it calls **AdFection**. Attackers bought ad placements through mainstream ad networks and exchanges, embedding JavaScript that ran when the ad rendered. A server-side eligibility check then decided which devices received the spyware. Al Jazeera Media Network provided evidence of at least 45 targeted devices between 2024 and 2025. The delivery broker is linked to Discover-Tech, which Citizen Lab describes as "a bridge between mercenary spyware companies and the advertising ecosystem."
## Technical Details
- **Type:** Technique (malvertising-based zero-click delivery) with associated malware (Candiru spyware, including a DLL recovered from a compromised Windows system)
- **Platform:** Android, iOS, and Windows. Ads were observed across 75,373 Android/iOS apps and 120,768 websites, though these figures are not infection counts.
- **Capabilities:** Zero-click delivery via rendered ads; target selection and filtering; device profiling, deanonymization, and fingerprinting (via Discover-Tech's Controlium platform); staged payload delivery. Candiru's DevilsTongue malware can steal files, credentials, and messages.
- **First Seen:** Campaign activity documented 2024–2025 (Al Jazeera devices). Ad operations observed March–June 2026. Report published October 2026. Earlier Candiru activity involved Windows and Chrome zero-days against journalists, activists, and politicians.
## MITRE ATT&CK Mapping
- **TA0043 - Reconnaissance**
- T1592 - Gather Victim Host Information (device fingerprinting via ad-delivered JavaScript)
- T1590 - Gather Victim Network Information (IP-based eligibility checks)
- **TA0042 - Resource Development**
- T1583 - Acquire Infrastructure (validation servers, NOAS/getAd servers, C2; ad placements purchased through ad networks)
- **TA0001 - Initial Access**
- T1189 - Drive-by Compromise (malicious ads rendered in the browser or app, with no user interaction)
- **TA0002 - Execution**
- T1059.007 - Command and Scripting Interpreter: JavaScript
- **TA0005 - Defense Evasion**
- T1480.001 - Execution Guardrails: Environmental Keying (payloads delivered only to eligible targets; other devices receive nothing)
- **TA0011 - Command and Control**
- T1071.001 - Application Layer Protocol: Web Protocols (HTTP/S to validation and C2 servers)
- **TA0009 - Collection / TA0006 - Credential Access** (based on DevilsTongue's documented capabilities)
- T1005 - Data from Local System
- T1555 - Credentials from Password Stores
*Mappings are analyst judgments from the article. The article does not describe persistence or the exact techniques used by the DLL, so those are not mapped.*
## Functionality
### Core Capabilities
- Ad-based delivery requiring only ad rendering (zero-click)
- Multi-stage delivery: ad JavaScript → NOAS/getAd eligibility server → Candiru validation server → spyware C2
- Target selection using IP address and ad identifiers
- Device profiling and fingerprinting through the Controlium platform
### Advanced Features
- Selective delivery designed to reduce exposure and avoid detection by researchers and platforms
- Traffic routed through an ad-tech broker, which obscures the operator behind the infrastructure
- Multi-vendor cooperation: Discover-Tech reportedly works with several spyware, hacking, and advertising vendors
- Scale: 3.77 billion bids and 442 million auctions won between March and June 2026. Citizen Lab estimates hundreds of thousands to millions of users were directed to the involved domains.
## Indicators of Compromise
The article does not publish hashes, file names, or domains. Obtain the full Citizen Lab report before building detections.
- **File Hashes:** Not provided in the article. A DLL was recovered from a compromised Windows system, but its hashes are not published here.
- **File Names:** Not provided. Refer to the Citizen Lab report.
- **Registry Keys:** Not provided.
- **Network Indicators:** Not provided in the article. Citizen Lab reportedly documents the NOAS/getAd server, Candiru validation servers, and C2 infrastructure. Defang any indicators (e.g., `hxxps://example[.]com`) when sharing.
- **Behavioral Indicators:**
- Ad iframes or scripts making requests to unexpected third-party endpoints shortly after rendering
- Browser or app processes contacting validation servers before spyware C2 traffic
- Requests that include device or ad identifiers and IP-based parameters in ad-tech contexts
- Unexpected DLL loading on Windows systems following browsing activity
## Associated Threat Actors
- **Candiru** (Israeli spyware vendor; also referred to as Saito Tech in public reporting)
- **Discover-Tech** (Israeli firm; ad-tech broker enabling delivery)
- Customers of Discover-Tech's Controlium platform (unnamed)
- Related: Intellexa (Predator spyware, "Aladdin" ad-based infection vector)
## Detection Methods
- **Signature-based:**
- Block known Discover-Tech, NOAS/getAd, and Candiru validation/C2 domains and IPs once confirmed from the Citizen Lab report
- Scan for the recovered DLL using hashes from Citizen Lab
- **Behavioral:**
- Alert on ad-tech domains that resolve to or communicate with infrastructure not previously seen in browsing baselines
- Hunt for unusual outbound connections from browsers, mobile apps, or ad SDKs
- Monitor for suspicious DLL loads from user-writable paths on Windows endpoints
- Correlate ad-network traffic with subsequent connections to newly registered or low-reputation domains
- **YARA Rules:** None are provided in the article. Check Citizen Lab and vendor publications for updates.
## Mitigation Strategies
- **Prevention:**
- Deploy ad-blocking and malvertising protection at the DNS, proxy, or endpoint layer, especially for high-risk users such as journalists, activists, and executives
- Block or restrict third-party ad domains and ad exchanges on sensitive devices
- Keep browsers, mobile OS, and apps patched to reduce exposure to zero-days used by Candiru
- Enable enhanced browser protections and mobile security modes (for example, Lockdown Mode on iOS) for high-risk users
- **Hardening:**
- Use MDM to enforce update policies and restrict unsanctioned browser extensions
- Segment and monitor networks used by high-risk personnel
- Enforce application allowlisting on Windows endpoints to limit unauthorized DLL loading
- Apply egress filtering so endpoints can only reach approved destinations
- **Organizational:**
- Include ad-based spyware scenarios in threat models for media organizations and at-risk groups
- Share IOCs with ad networks and platforms so they can detect and remove malicious ads, as Google, IAB Europe, Beeswax, Eskimi, and Vungle did after the Citizen Lab disclosure
## Related Tools/Techniques
- **Aladdin (Intellexa/Predator):** Documented by Amnesty International in late 2025. Used ads for zero-click Predator infection and was revealed through leaked Intellexa marketing materials.
- **DevilsTongue (Candiru):** Windows spyware capable of stealing files, credentials, and messages.
- **NSO Group Pegasus:** Zero-click spyware using exploits instead of ads. Included in US sanctions alongside Candiru.
- **Malvertising campaigns in general:** Ad-based delivery of commodity malware, which shares the drive-by delivery model but typically lacks this level of targeting.
---
**Analyst notes:**
- The article lists the spyware as Candiru and the broker as "Discover-Tech" in some places and "Discovere-Tech" in others. The first spelling appears to be correct.
- It also refers to the Intellexa technique as both "Aladdin" and "Alladin." The correct spelling is "Aladdin."
- The article's mention of the Blue Report 2026 is promotional and not relevant to the threat analysis.