Candiru - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/candiru/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 21 Oct 2026 07:58:02 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAdFection: Targeted mobile advertising exploited for zero-click spyware deliveryhttps://feed.craftedsignal.io/briefs/2026-10-adfection-spyware/Wed, 21 Oct 2026 07:58:02 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-adfection-spyware/The AdFection campaign, facilitated by the ad-broker Discover-Tech and attributed to the mercenary vendor Candiru, delivers zero-click exploits via targeted mobile advertising to compromise iOS and Android devices.Citizen Lab identified the AdFection campaign, which leverages a malicious advertising pipeline to deliver zero-click exploits to mobile devices. Discover-Tech, an ad-brokering firm, served as the distribution bridge, allowing mercenary spyware developers to bid on ad impressions targeting specific user demographics based on mobile IDs, location, and IP addresses. Once a targeted individual loaded a webpage or opened an app containing the malicious ad, the device executed code that connected to Candiru's (rebranded as Integrity Labs) command-and-control servers, resulting in a zero-click exploit delivery. The campaign was confirmed to have infected 45 devices at Al Jazeera between 2024 and 2025.

Attack Chain

  1. Profiling: Attackers assemble detailed user profiles using unique mobile IDs, location, and IP addresses.
  2. Brokering: The malicious ad is placed into the legitimate advertising ecosystem via the Discover-Tech brokerage.
  3. Delivery: The target loads a webpage or opens a mobile application that displays the malicious advertisement.
  4. Execution: JavaScript or similar code within the advertisement executes upon rendering.
  5. C2 Communication: The executing code initiates a connection to infrastructure controlled by Candiru (Integrity Labs).
  6. Exploitation: The C2 infrastructure delivers a zero-click exploit payload to the target device, leading to full infection.

Impact

Citizen Lab confirmed 45 infections at Al Jazeera between 2024 and 2025. The malware facilitates persistent spyware infection, enabling invisible monitoring of targeted journalists, government officials, and critical infrastructure personnel.

Recommendation

  • Implement network-level ad-blocking solutions across corporate and newsroom environments to disrupt the delivery of malicious ad creative.
  • Enforce regular mobile operating system and application updates to mitigate the zero-click vulnerabilities leveraged in this campaign.
  • Advise high-risk individuals to reset mobile advertising identifiers regularly and consider disabling personalized ad tracking at the OS level.
  • Configure mobile device management (MDM) policies to restrict unnecessary application permissions and background data access.
]]>highthreatmercenary-spywaread-fraudmobile-threatsdrive-by-download