Skip to content
CertGPS

Candiru Spyware Delivered via Targeted Ads

Researchers at Citizen Lab discovered a zero-click attack that delivered Candiru spyware to devices via targeted online advertisements. The attack, called AdFection, was linked to Israeli firm Discovere-Tech and affected at least 45 devices between 2024 and 2025.

Severity awaiting reviewZero daySecurity feature
R
Robert
Incident date
Published
Read time
6 min
View source
On this page

Related certifications

Tags

  • security-news
  • zero-day|security-feature
  • cybersecurity

Source

bleepingcomputer.com

Note: This analysis is based on publicly available information from source article. Facts are clearly separated from technical analysis.

Executive Summary

In 2024, the Al Jazeera Media Network was targeted by Candiru spyware via targeted online advertisements. This incident, known as AdFection, was later documented by Amnesty International in 2025, involving ads that infected targets with Predator spyware. Citizen Lab investigated the attacks and referred to this technique as AdFection. The advertising operation placed 3.77 billion bids and won 442 million auctions, affecting at least 45 devices and multiple companies, including Al Jazeera Media Network, Google, IAB Europe, Beeswax, Eskimi, Vungle, and Discovere-Tech. The incident highlights the vulnerability of online advertising and the potential for malicious actors to exploit this ecosystem.

The AdFection technique involves embedding JavaScript in ads that contact the 'NOAS server' when rendered. The NOAS server determines if a target is eligible to receive JavaScript code using multiple parameters, such as IP address and ad identifiers. Candiru is an Israeli spyware vendor that sells surveillance tools, officially only to governments, and has developed malware for Windows called DevilsTongue, which can steal files, credentials, and messages.

This incident matters because it demonstrates the potential for malicious actors to exploit the online advertising ecosystem and target individuals and organizations with sophisticated spyware. It also highlights the need for improved security measures and monitoring approaches to detect and prevent such attacks.

What Happened: Timeline

✅ Verified Facts

  • 2024: Al Jazeera Media Network was targeted by Candiru spyware via targeted online advertisements.
  • 2025: Similar method (Aladdin) was documented by Amnesty International, involving ads that infected targets with Predator spyware.
  • 2025-2026: Citizen Lab investigated the attacks and referred to this technique as AdFection.
  • 2026-03-06: Advertising operation placed 3.77 billion bids and won 442 million auctions.
  • 2026-06: Advertising operation continued.
  • October 16, 2026: Citizen Lab released a report on the AdFection technique.

Technical Deep Dive

Understanding AdFection

What is it?

AdFection is a technique used to deliver Candiru spyware to devices via targeted online advertisements. The technique involves embedding JavaScript in ads that contact the 'NOAS server' when rendered. The NOAS server determines if a target is eligible to receive JavaScript code using multiple parameters, such as IP address and ad identifiers.

How does it work?

The AdFection technique works as follows:

  1. A malicious actor creates an ad that contains embedded JavaScript code.
  2. The ad is served to a target device via an online advertising platform.
  3. When the ad is rendered, the JavaScript code contacts the NOAS server.
  4. The NOAS server determines if the target is eligible to receive the JavaScript code based on multiple parameters, such as IP address and ad identifiers.
  5. If the target is eligible, the NOAS server delivers the JavaScript code to the target device.
  6. The JavaScript code is executed on the target device, allowing the malicious actor to gain access to the device and steal sensitive information.

Security considerations

The AdFection technique is relevant to the incident because it demonstrates the potential for malicious actors to exploit the online advertising ecosystem and target individuals and organizations with sophisticated spyware. The technique also highlights the need for improved security measures and monitoring approaches to detect and prevent such attacks.

JavaScript is a programming language that is widely used in web development. It is often used to create interactive web pages and is also used in online advertising to create dynamic ads. In the context of the AdFection technique, JavaScript is used to embed code in ads that contact the NOAS server when rendered.

The NOAS server is a server that determines if a target is eligible to receive JavaScript code based on multiple parameters, such as IP address and ad identifiers. The NOAS server is a critical component of the AdFection technique, as it allows the malicious actor to target specific devices and steal sensitive information.

Analysis: What Went Wrong

📊 Professional Analysis

Technical Root Cause

The technical root cause of the incident is the AdFection technique, which allows malicious actors to deliver Candiru spyware to devices via targeted online advertisements. The technique is based on a vulnerability in the online advertising ecosystem, which allows malicious actors to exploit the system and target individuals and organizations with sophisticated spyware.

Contributing Factors

The contributing factors to the incident include:

  • The use of targeted online advertisements, which allows malicious actors to target specific devices and steal sensitive information.
  • The lack of security measures and monitoring approaches to detect and prevent such attacks.
  • The use of sophisticated spyware, such as Candiru, which allows malicious actors to gain access to devices and steal sensitive information.

Lessons for Security Professionals

Key Takeaways

  1. The online advertising ecosystem is vulnerable to exploitation by malicious actors.
  2. The use of targeted online advertisements can be used to deliver sophisticated spyware to devices.
  3. Improved security measures and monitoring approaches are needed to detect and prevent such attacks.

Prevention & Detection

How to Prevent

  • Implement security measures, such as firewalls and intrusion detection systems, to prevent malicious actors from exploiting the online advertising ecosystem.
  • Use monitoring approaches, such as log analysis and anomaly detection, to detect and prevent such attacks.
  • Educate users about the risks associated with online advertising and the importance of using secure browsers and ad blockers.

How to Detect

  • Monitor online advertising platforms for suspicious activity, such as unusual ad traffic or malicious code.
  • Use log analysis and anomaly detection to identify potential security threats.
  • Implement incident response plans to quickly respond to and contain security incidents.
View related certification topics

Security+ (CompTIA)

  • Domain 1.0: Network Security
  • Domain 2.0: Compliance and Operational Security
  • Domain 3.0: Threats and Vulnerabilities
  • Domain 4.0: Application, Data and Host Security

CySA+ (CompTIA)

  • Domain 1.0: Security and Risk Management
  • Domain 2.0: Asset Security
  • Domain 3.0: Security Architecture and Engineering
  • Domain 4.0: Communication and Network Security
  • Domain 5.0: Identity and Access Management

CEH (EC Council)

  • Domain 1.0: Network Security
  • Domain 2.0: Vulnerability Assessment
  • Domain 3.0: Malware Analysis
  • Domain 4.0: Web Application Security
  • Domain 5.0: Incident Response

CISSP (ISC2)

  • Domain 1.0: Security and Risk Management
  • Domain 2.0: Asset Security
  • Domain 3.0: Security Architecture and Engineering
  • Domain 4.0: Communication and Network Security
  • Domain 5.0: Identity and Access Management

OSCP (Offensive Security)

  • Domain 1.0: Network Exploitation
  • Domain 2.0: System Exploitation
  • Domain 3.0: Cryptography
  • Domain 4.0: Web Application Exploitation
  • Domain 5.0: Incident Response

CISM (ISACA)

  • Domain 1.0: Information Security Governance
  • Domain 2.0: Information Risk Management
  • Domain 3.0: Information Security Program Management
  • Domain 4.0: Information Security Incident Management

Note: The above certifications are just a few examples of the many certifications that are relevant to this incident. The specific domains and topics related to this incident may vary depending on the certification.

Source

This analysis is based on: https://www.bleepingcomputer.com/news/security/zero-click-attacks-used-targeted-ads-to-deliver-candiru-spyware/

This incident analysis is provided for educational purposes. Facts are cited from the source article, while technical analysis represents professional interpretation.