[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fdUTBiFxD0gB-Kzntg0Yv2Sxa0epHHE9WddHetaHg2jQ":3},{"article":4,"iocs":55,"watch_terms":60,"solutions":61,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"85050e46-f281-44fa-9a1b-22d585b931f7","Zero-click attacks used targeted ads to deliver Candiru spyware","zero-click-attacks-used-targeted-ads-to-deliver-candiru-spyware-f10c7f","Candiru spyware was delivered to devices at Al Jazeera Media Network via targeted online advertisements in a zero-click attack that required only rendering the malicious ads on the victim's device. [...]","Candiru spyware was delivered to devices at Al Jazeera Media Network through targeted online advertisements using a zero-click attack technique dubbed AdFection. This method, linked to Israeli firm Discovere-Tech, requires only the rendering of malicious ads to infect devices, bypassing the need for user interaction. Researchers estimate millions of users may have been exposed to these ads.","Candiru spyware delivered via zero-click ads targeting Al Jazeera Media Network.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fzero-click-attacks-used-targeted-ads-to-deliver-candiru-spyware\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F16\u002Fspywareads.jpg","2026-10-16T17:20:03+00:00","2026-10-16T18:00:11.416971+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"Candiru","threat_actor",{"name":21,"type":22},"Discovere-Tech","vendor",{"name":24,"type":25},"Controlium","product",{"name":27,"type":25},"DevilsTongue",{"name":29,"type":25},"AdFection",{"name":31,"type":25},"Aladdin","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":54},{"id":32,"icon":34,"name":35,"slug":36},[56,58],{"type":52,"value":18,"context":57},"Spyware delivered via targeted ads",{"type":52,"value":27,"context":59},"Malware developed by Candiru for Windows",[21,24,27],{"controls":62,"vendors":147},[63,92,120],{"slug":64,"name":65,"problem":66,"products":67},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":36,"name":93,"problem":94,"products":95},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"slug":121,"name":122,"problem":123,"products":124},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[125,133,139],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":134,"product_name":135,"url":137,"description":138},"dnsfilter","DNSFilter","\u002Fvendor-logos\u002Fdnsfilter.png","https:\u002F\u002Fwww.dnsfilter.com\u002F","DNS filtering for offices and roaming devices.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",[],{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":166},"zero-click-ad-spyware-bypasses-user-interaction-to-compromise-devices","Zero-Click Ad Spyware Bypasses User Interaction to Compromise Devices","The AdFection attack demonstrates that simply rendering a malicious advertisement — without any click or user interaction — is sufficient to deliver sophisticated spyware like Candiru to targeted devices. This exploits the implicit trust organizations place in third-party ad networks and the underlying browser\u002FOS vulnerabilities they leverage. The involvement of a commercial surveillance vendor (Discovere-Tech) highlights the growing supply chain risk posed by the ad-tech ecosystem. At scale, millions of users can be silently compromised before any indicator of attack is detected, making traditional user-education defenses entirely ineffective here. Organizations must treat ad rendering as an active attack surface, not a passive content delivery mechanism.",[153,154,155,156,157,158,159,160,161,162,163,164,165],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 7 – Continuous Vulnerability Management","CIS Control 9 – Email and Web Browser Protections","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 SA-9 – External System Services (Supply Chain)","NIST SP 800-53 SC-18 – Mobile Code","NIST SP 800-53 RA-5 – Vulnerability Monitoring and Scanning","NIST CSF DE.CM-1 – Network Monitoring","GDPR Article 32 – Security of Processing","GDPR Article 25 – Data Protection by Design and by Default","MITRE ATT&CK T1189 – Drive-by Compromise","MITRE ATT&CK T1195 – Supply Chain Compromise",{}]