Loading malware…
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
« Al Jazeera : au moins 45 appareils infectés en 2024-2025 via des publicités Discover-Tech contenant le spyware Candiru. »
« Al Jazeera : au moins 45 appareils infectés en 2024-2025 via des publicités Discover-Tech contenant le spyware Candiru. »
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Les chercheurs nomment cette technique AdFection. [...] L’infection est zero-click : le simple affichage de la publicité suffit.
Ce JavaScript charge un exploit navigateur ou une iframe pointant vers un serveur validateur Candiru, puis vers un serveur C&C Candiru.
obfuscation XOR 48 octets avec null-terminator factice
T1071.001 — Application Layer Protocol: Web Protocols (Command and Control) [...] C&C hardcodés : fearevolve[.]com, jobmarcher[.]com
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.