[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8gWVlIrRElb1mvO5HXBd08uZN7Ygvv8uJ69bPdAIeYk":3},{"article":4,"iocs":50,"watch_terms":53,"solutions":54,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"577e39a7-f4e7-49d3-a327-cc44eb45d90a","Targeted Ads Used to Infect Al Jazeera Devices with Candiru Spyware","targeted-ads-used-to-infect-al-jazeera-devices-with-candiru-spyware-fdc6a3","Citizen Lab found targeted ads delivered Candiru spyware to Al Jazeera devices without clicks, while the same ad…","Citizen Lab and Confiant have revealed a new technique called 'AdFection' where targeted advertisements are used to deliver Candiru spyware to devices without requiring user interaction. At least 45 Al Jazeera devices were targeted in 2024-2025, with affected devices connecting to infrastructure operated by Israeli advertising company Discover-Tech, which then linked to Candiru spyware servers. The same ad system was also found on networks belonging to NATO, the UN, and various government agencies.","Candiru spyware delivered via zero-click targeted ads to Al Jazeera devices.","https:\u002F\u002Fhackread.com\u002Ftargeted-ads-infect-al-jazeera-devices-candiru-spyware\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002Ftargeted-ads-infect-al-jazeera-devices-candiru-spyware.jpg","2026-10-15T20:29:48+00:00","2026-10-15T22:00:07.50957+00:00",9,[17,20,23,25],{"name":18,"type":19},"Candiru spyware","product",{"name":21,"type":22},"Discover-Tech","vendor",{"name":24,"type":22},"Candiru",{"name":26,"type":22},"Integrity Labs","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":27,"icon":29,"name":30,"slug":31},null,"Malware","malware",[33,38,43,45],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":44},{"id":27,"icon":29,"name":30,"slug":31},{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51],{"type":31,"value":24,"context":52},"Mercenary spyware developed by Candiru (also known as Integrity Labs)",[21,24,26],{"controls":55,"vendors":143},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":86,"name":87,"problem":88,"products":89},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":115,"name":116,"problem":117,"products":118},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",[],{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":159},"malicious-ad-networks-weaponized-to-silently-deploy-candiru-spyware","Malicious Ad Networks Weaponized to Silently Deploy Candiru Spyware","The 'AdFection' technique exploits trusted third-party advertising infrastructure to deliver commercial spyware without any user interaction, bypassing traditional phishing and social engineering defenses. By compromising or co-opting a legitimate ad network (Discover-Tech), attackers gained a stealthy, pre-approved delivery channel into high-value organizational networks including Al Jazeera, NATO, and the UN. This highlights the critical risk of implicit trust granted to third-party content delivery systems — ad networks represent a largely unscrutinized supply chain vector embedded in everyday browsing. The zero-click nature of the attack means conventional security awareness training provides no protection, making technical controls and supply chain vetting essential. Organizations that fail to treat advertising and analytics scripts as potential threat vectors leave a significant blind spot in their security posture.",[149,150,151,152,153,154,155,156,157,158],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-161: Supply Chain Risk Management","NIST CSF DE.CM-7: Monitoring for Unauthorized Personnel, Connections, Devices, and Software","NIST SP 800-53 SC-18: Mobile Code","NIST SP 800-53 SA-9: External Information System Services","GDPR Article 32: Security of Processing (for EU-facing organizations)","ITIL: Supplier Management Practice","ISO\u002FIEC 27036: Information Security for Supplier Relationships",{}]