Zero-click attacks used targeted ads to deliver Candiru spyware
Candiru spyware delivered via zero-click ads targeting Al Jazeera Media Network.
Run Discovere-Tech?
Get an email when a reviewed story names Discovere-Tech, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Candiru spyware was delivered to devices at Al Jazeera Media Network through targeted online advertisements using a zero-click attack technique dubbed AdFection. This method, linked to Israeli firm Discovere-Tech, requires only the rendering of malicious ads to infect devices, bypassing the need for user interaction. Researchers estimate millions of users may have been exposed to these ads.
The lesson from this incident
Full lessonThe AdFection attack demonstrates that simply rendering a malicious advertisement — without any click or user interaction — is sufficient to deliver sophisticated spyware like Candiru to targeted devices. This exploits the implicit trust organizations place in third-party ad networks and the underlying browser/OS vulnerabilities they leverage. The involvement of a commercial surveillance vendor (Discovere-Tech) highlights the growing supply chain risk posed by the ad-tech ecosystem. At scale, millions of users can be silently compromised before any indicator of attack is detected, making traditional user-education defenses entirely ineffective here. Organizations must treat ad rendering as an active attack surface, not a passive content delivery mechanism.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
Indicators of Compromise
- malware — Candiru
- malware — DevilsTongue