{"id":"candiru-adfection-spyware-ads-oct-2026","category":"breach","status":"live","title":"Candiru spyware infected Al Jazeera devices through no-click advertisements: AdFection","tldr":"Targeted advertisements delivered Candiru spyware to Al Jazeera devices without a click. Advertising platforms restricted Discover-Tech, but no complete remedy is confirmed. Block ads and seek specialist help if you face targeted surveillance.","summary":"Citizen Lab’s 15 October investigation confirmed that targeted advertisements delivered Candiru spyware to Al Jazeera devices during 2024–2025 without anyone clicking them. It attributed the advertising delivery to Discover-Tech. At least 45 devices were targeted, and a Windows spyware sample was recovered. MyCERT subsequently described all 45 as infected; Citizen Lab’s primary investigation does not give that infection total. The wider advertising operation reached websites and mobile apps, but advertisement exposure does not establish infection. Google blocked Discover-Tech from its advertising exchanges and added Safe Browsing protections; Beeswax removed it, Liftoff paused access, and IAB Europe suspended its listing. As at 3 November, the reviewed sources identify no specific affected software versions, CVEs or update that conclusively fixes this attack chain. They also provide no confirmation that all compromised devices were cleaned or that the operation has ended. Discover-Tech and Candiru had not responded within Citizen Lab’s stated deadline.","action":"Use a trusted browser ad blocker and disable mobile ad tracking to reduce exposure. If your work or public profile puts you at risk of targeted surveillance, ask your security team or a spyware specialist for help; advertising-platform blocks do not clean an infected device.","product":"Al Jazeera devices; websites and mobile apps displaying Discover-Tech advertisements","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["candiru","adfection","spyware","zero-click","malvertising","al-jazeera"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Beeswax response to Citizen Lab’s request for comment","url":"https://citizenlab.ca/wp-content/uploads/2026/10/Beeswax-Response-to-Request-for-Comment.pdf","by":"Beeswax","date":"2026-10-13"},{"kind":"advisory","title":"Liftoff response to Citizen Lab’s request for comment","url":"https://citizenlab.ca/wp-content/uploads/2026/10/Liftoff-Response-to-Request-for-Comment.pdf","by":"Liftoff","date":"2026-10-12"},{"kind":"advisory","title":"IAB Europe response to Citizen Lab","url":"https://citizenlab.ca/wp-content/uploads/2026/10/Citizen-Lab-Right-to-Reply-IAB.pdf","by":"IAB Europe","date":"2026-10-15"},{"kind":"research","title":"Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware","url":"https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/","by":"Citizen Lab","date":"2026-10-15"},{"kind":"research","title":"ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming","url":"https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming","by":"Confiant","date":"2026-10-15"},{"kind":"news","title":"Targeted ads installed Candiru spyware in zero-click attacks","url":"https://www.bleepingcomputer.com/news/security/zero-click-attacks-used-targeted-ads-to-deliver-candiru-spyware/","by":"BleepingComputer","date":"2026-10-16"},{"kind":"advisory","title":"MA-1485.102026: Zero-Click Spyware Delivered via Targeted Online Advertising (AdFection)","url":"https://mycert.org.my/portal/advisory?id=MA-1485.102026","by":"MyCERT","date":"2026-10-22"}],"started":"2026-10-15","closed":null,"created":"2026-11-03T21:18:17.119Z","updated":"2026-11-03T21:18:17.119Z","cve_notes":[],"timeline":[{"at":"2026-10-22","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"MyCERT published an advisory and reported that two command servers embedded in the recovered Windows spyware sample no longer resolved. It warned that infrastructure could change and recommended forensic examination for people at high risk.","url":"https://mycert.org.my/portal/advisory?id=MA-1485.102026","by":"MyCERT","patch":null},{"at":"2026-10-15","added":"2026-11-03T21:16:05.524Z","kind":"disclosed","text":"Citizen Lab published AdFection, confirming Candiru infections at Al Jazeera through advertisements requiring no click. At least 45 devices were targeted during 2024–2025; exact attack dates and the total infected were not published.","url":"https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/","by":"Citizen Lab","patch":"na"},{"at":"2026-10-13","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"Beeswax confirmed it had already removed Discover-Tech from its Buyer Cloud advertising platform following suspicious activity and independent security validation.","url":"https://citizenlab.ca/wp-content/uploads/2026/10/Beeswax-Response-to-Request-for-Comment.pdf","by":"Beeswax","patch":null},{"at":"2026-10-12","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"Liftoff said it had paused all Discover-Tech access while reviewing the allegations.","url":"https://citizenlab.ca/wp-content/uploads/2026/10/Liftoff-Response-to-Request-for-Comment.pdf","by":"Liftoff","patch":null},{"at":"2026-10-08","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"IAB Europe suspended Discover-Tech from its Global Vendor List after an audit found policy violations. Its subsequent statement distinguished suspension from permanent expulsion.","url":"https://citizenlab.ca/wp-content/uploads/2026/10/Citizen-Lab-Right-to-Reply-IAB.pdf","by":"IAB Europe","patch":null},{"at":"2026-04-12","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"An advertisement triggered Confiant’s detection systems, prompting its investigation into Discover-Tech’s device profiling and connections to Candiru infrastructure.","url":"https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming","by":"Confiant","patch":null}],"url":"https://hard.fyi/live/candiru-adfection-spyware-ads-oct-2026/","json":"https://hard.fyi/api/live?id=candiru-adfection-spyware-ads-oct-2026"}