{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/candiru/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["Candiru"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Integrity Labs Spyware","Discover-Tech (ad brokering services)"],"_cs_severities":["high"],"_cs_tags":["mercenary-spyware","ad-fraud","mobile-threats","drive-by-download"],"_cs_type":"threat","_cs_vendors":["Candiru"],"content_html":"\u003cp\u003eCitizen Lab identified the AdFection campaign, which leverages a malicious advertising pipeline to deliver zero-click exploits to mobile devices. Discover-Tech, an ad-brokering firm, served as the distribution bridge, allowing mercenary spyware developers to bid on ad impressions targeting specific user demographics based on mobile IDs, location, and IP addresses. Once a targeted individual loaded a webpage or opened an app containing the malicious ad, the device executed code that connected to Candiru's (rebranded as Integrity Labs) command-and-control servers, resulting in a zero-click exploit delivery. The campaign was confirmed to have infected 45 devices at Al Jazeera between 2024 and 2025.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eProfiling: Attackers assemble detailed user profiles using unique mobile IDs, location, and IP addresses.\u003c/li\u003e\n\u003cli\u003eBrokering: The malicious ad is placed into the legitimate advertising ecosystem via the Discover-Tech brokerage.\u003c/li\u003e\n\u003cli\u003eDelivery: The target loads a webpage or opens a mobile application that displays the malicious advertisement.\u003c/li\u003e\n\u003cli\u003eExecution: JavaScript or similar code within the advertisement executes upon rendering.\u003c/li\u003e\n\u003cli\u003eC2 Communication: The executing code initiates a connection to infrastructure controlled by Candiru (Integrity Labs).\u003c/li\u003e\n\u003cli\u003eExploitation: The C2 infrastructure delivers a zero-click exploit payload to the target device, leading to full infection.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eCitizen Lab confirmed 45 infections at Al Jazeera between 2024 and 2025. The malware facilitates persistent spyware infection, enabling invisible monitoring of targeted journalists, government officials, and critical infrastructure personnel.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImplement network-level ad-blocking solutions across corporate and newsroom environments to disrupt the delivery of malicious ad creative.\u003c/li\u003e\n\u003cli\u003eEnforce regular mobile operating system and application updates to mitigate the zero-click vulnerabilities leveraged in this campaign.\u003c/li\u003e\n\u003cli\u003eAdvise high-risk individuals to reset mobile advertising identifiers regularly and consider disabling personalized ad tracking at the OS level.\u003c/li\u003e\n\u003cli\u003eConfigure mobile device management (MDM) policies to restrict unnecessary application permissions and background data access.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T07:58:02Z","date_published":"2026-10-21T07:58:02Z","id":"https://feed.craftedsignal.io/briefs/2026-10-adfection-spyware/","summary":"The AdFection campaign, facilitated by the ad-broker Discover-Tech and attributed to the mercenary vendor Candiru, delivers zero-click exploits via targeted mobile advertising to compromise iOS and Android devices.","title":"AdFection: Targeted mobile advertising exploited for zero-click spyware delivery","url":"https://feed.craftedsignal.io/briefs/2026-10-adfection-spyware/"}],"language":"en","title":"CraftedSignal Threat Feed - Candiru","version":"https://jsonfeed.org/version/1.1"}