Candiru (Threat actor): news timeline & CVEs

No click required: How the ad industry became a pipeline for mercenary spyware

Citizen Lab says Discover-Tech used ad auctions to profile devices and deliver Candiru spyware without a click.

The Citizen Lab says Discover-Tech used its Controlium advertising platform, described as AdFection, to win real-time ad auctions, fingerprint devices, and silently deliver exploit code when an ad rendered. Over four months its ads appeared on about 120,768 websites and in 75,373 apps, including impressions on networks associated with NATO and major technology companies; an impression alone is not an infection. Israeli mercenary-spyware vendor Candiru used the path to infect devices at Al Jazeera. Google, IAB Europe, Beeswax, Vungle, and Eskimi removed Discover-Tech’s access after disclosure.

CSO Onlineupdated Oct 16, 17:20 UTC · 10h agofirst Oct 16, 01:02 UTC · 1d agoMalware in the wild 12 sources1· 1 read

Targeted ads delivered 0-click exploits to install mercenary malware

Citizen Lab says Discover-Tech ads delivered Candiru zero-click exploits that installed mercenary spyware.

Citizen Lab reported the AdFection campaign, in which Discover-Tech served targeted ads that delivered zero-click exploits and installed mercenary spyware from Candiru, also known as Integrity Labs. Ad code contacted Candiru servers, which returned an exploit and payload when the ad rendered. Google, IAB Europe, Beeswax, Vungle, and Eskimi have since removed, paused, or blocked Discover-Tech. Impressions appeared on networks linked to NATO, the United Nations, European lawmaking bodies, Australian critical infrastructure, and Norwegian and Swedish government and military agencies. The report does not name the vulnerabilities or the final malware.

Ars Technica · Securityupdated Oct 16, 17:20 UTC · 10h agofirst Oct 15, 20:32 UTC · 1d agoThreat actor in the wild 12 sources

Zero-click spyware infecting devices through online ads, researchers say

Citizen Lab says Candiru used Discover-Tech ads to zero-click infect Al Jazeera journalists and reach sensitive government networks.

Citizen Lab and Confiant say Israeli ad firm Discover-Tech used its Controlium platform to deliver zero-click spyware through online ads. The ads infected devices of at least 45 Al Jazeera journalists and were rendered on sensitive networks including NATO, the U.S. Department of Defense, Estonia’s RIA, the IAEA, and the ICC. Candiru allegedly hired Discover-Tech; the ads sent millions of devices to Candiru servers and the spyware can record calls, enable microphones, and steal messages. Researchers reviewed four billion placement records, and Google and other platforms have since blocked Discover-Tech.

The Recordupdated Oct 16, 17:20 UTC · 10h agofirst Oct 15, 19:00 UTC · 1d agoThreat actor in the wild 12 sources2

Hackers Use Online Ads to Infect Devices With Spyware Without a Single Click

Citizen Lab says Candiru spyware reached Al Jazeera devices through zero-click malicious online ads called AdFection.

Citizen Lab reported the first public case of zero-click mercenary spyware delivered through targeted online ads, a technique it calls AdFection. With high confidence it linked 2024-2025 attacks on at least 45 Al Jazeera devices to Candiru, now rebranded Integrity Labs, using ads bought by Israeli firm Discover-Tech. Malicious ad code returned exploit JavaScript only to selected identifiers, then devices contacted Candiru validator and command-and-control servers including fearevolve[.]com and jobmarcher[.]com. A recovered Windows DLL persisted via COM hijack; Google and ad platforms have since cut Discover-Tech off.

GBHackersupdated Oct 16, 17:20 UTC · 10h agofirst Oct 15, 14:51 UTC · 1d agoThreat actor in the wild 12 sources3· 2 reads

Spyware vendors found a way to make targeted ads even worse

Citizen Lab says Discover-Tech ads delivered Candiru zero-click spyware that infected Al Jazeera devices.

Citizen Lab reports the first publicly confirmed zero-click mercenary spyware attacks delivered through online advertising, a technique it calls AdFection. Israel-based Discover-Tech allegedly used its Controlium real-time bidding platform, approved by Google and IAB Europe since 2020, to identify targets and serve malicious ads. At least 45 Al Jazeera devices were infected in 2024 and 2025 with spyware from Candiru, now known as Integrity Labs. Discover-Tech ads appeared across more than 70,000 apps and 120,000 websites, including government, defense, and NATO networks, although infections there were not confirmed; Google and other ad platforms have since cut off the company.

The Register · Securityupdated Oct 16, 17:20 UTC · 10h agofirst Oct 15, 14:31 UTC · 1d agoThreat actor in the wild 12 sources

AdFection: Beyond the Click: Citizen Lab Exposes Ad-Delivered Spyware Networks

Citizen Lab says Candiru used Discover-Tech ads for zero-click spyware, hitting at least 45 Al Jazeera devices.

Citizen Lab reports that Discover-Tech's MyDSP advertising platform was used to profile devices and deliver exploits without a click, and links the operation to Israeli spyware vendor Candiru, later known as Integrity Labs. From March through June 2026, MyDSP bid on 3,770,286,576 impressions and won about 441,954,291, spanning more than 120,000 websites and 70,000 apps. Network logs show at least 45 Al Jazeera devices were targeted in 2024 and 2025 with Candiru spyware delivered through those ads. Google, IAB Europe, Beeswax, Vungle, and Eskimi have since restricted Discover-Tech's access.

Security Affairsupdated Oct 16, 17:20 UTC · 10h agofirst Oct 15, 14:21 UTC · 1d agoThreat actor in the wild 12 sources2

Just Viewing an Online Ad Can Infect Your Device With Spyware, Researchers Reveal

Citizen Lab says Candiru spyware reached Al Jazeera devices through zero-click code hidden in online advertisements.

Citizen Lab published what it calls the first public technical proof of zero-click mercenary spyware delivered through targeted ads, a method it named AdFection. At least 45 Al Jazeera devices were targeted in 2024 and 2025 with spyware linked to Israeli vendor Candiru, now Integrity Labs. Discover-Tech's Controlium platform matched advertising IDs, cookies, or IP addresses and could return JavaScript that started infection after an ad loaded. Investigators tied a recovered Windows DLL to Candiru; it used COM hijacking and a 48-byte repeating XOR routine. After notification, Google and several ad platforms removed or suspended Discover-Tech.

Cyber Security Newsupdated Oct 16, 17:20 UTC · 10h agofirst Oct 15, 14:16 UTC · 1d agoThreat actor in the wild 12 sources

Citizen Lab says governments are abusing online ads to hack people with ‘zero-click’ spyware

Citizen Lab says Candiru and Bindecy used Discover-Tech ads to deliver zero-click spyware, including against Al Jazeera.

Citizen Lab says Israeli firm Discover-Tech let mercenary spyware makers use its Controlium advertising platform to deliver malicious ads. At least Candiru and Bindecy used the platform, and Candiru’s zero-click spyware infected at least 45 Al Jazeera Windows computers in 2024 and 2025. Researchers recovered exposed dashboard code, login records, and billions of bidding records showing ads displayed across apps and sites from March to June 2026, including devices tied to militaries, governments, and critical infrastructure. Confiant also saw potentially malicious ads on International Atomic Energy Agency and International Criminal Court networks, though infection there is unconfirmed.

TechCrunch · Securityupdated Oct 16, 17:20 UTC · 10h agofirst Oct 15, 10:00 UTC · 1d agoThreat actor in the wild 12 sources

‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads

Citizen Lab says Candiru spyware infected Al Jazeera phones through zero-click ads placed by Discover-Tech.

Citizen Lab reported that zero-click “AdFection” attacks infected devices through online ads, including 45 Al Jazeera phones targeted in 2024 and 2025. Israeli firm Discover-Tech’s Controlium platform allegedly sent devices to infrastructure tied to Candiru spyware, sometimes without a visible ad. Researchers estimate millions of devices were directed toward those servers, with linked ads shown in more than 70,000 apps and 120,000 websites. Google, IAB Europe, and Beeswax subsequently blocked or suspended Discover-Tech.

WIRED · Securityupdated Oct 16, 17:20 UTC · 10h agofirst Oct 15, 10:00 UTC · 1d agoMalware in the wild 12 sources2· 1 read

AdFection: How mercenary spyware invades victims’ devices through targeted advertising

Citizen Lab says Discover-Tech ads delivered Candiru zero-click spyware, infecting Al Jazeera devices.

The Citizen Lab and Confiant disclosed AdFection, a campaign in which Israeli company Discover-Tech used targeted advertising to direct devices to Candiru spyware servers without a click. Researchers linked at least 45 Al Jazeera devices to Candiru infections with high confidence, and said the ads also appeared on networks including the U.S. Department of Defense, NATO, and the IAEA. From March through June, Discover-Tech ads were seen on more than 120,000 websites and 70,000 mobile apps. Google and IAB Europe removed the company from approved vendor lists. A related actor, DARK CARTOGRAPHER, is described as linking advertising IDs to phone numbers by exploiting mobile-carrier flaws.

CyberScoopupdated Oct 16, 17:20 UTC · 10h agofirst Oct 15, 10:00 UTC · 1d agoMalware in the wild 12 sources

Candiru

Timeline10 articles

Appears with