Loading story…
Citizen Lab reported that at least 45 Al Jazeera devices were targeted in 2024 and 2025 through online advertisements linked with high confidence to Israeli spyware maker Candiru. The reported zero-click attacks required no user interaction: advertisements collected device identifiers, while backend servers selectively delivered attack code to targeted devices. Researchers recovered spyware from one compromised device but did not recover the initial browser or application exploit, leaving the initial exploitation stage inferred from infrastructure and traffic evidence. Discover-Tech supplied the advertisements, and several advertising platforms subsequently removed or restricted its access.
The advertising infrastructure reached approximately 75,000 mobile applications and 120,000 websites, including sensitive institutional networks, but advertisement exposure does not establish infection. The findings extend earlier reporting on Candiru’s operations: Recorded Future’s Insikt Group identified eight associated infrastructure clusters, five assessed as highly likely active as of June 2025, while noting unresolved questions about advertising-based infection and current mobile capabilities. Its report documented Candiru’s DevilsTongue Windows spyware capabilities, including credential theft, file extraction, message access, and session impersonation; those capabilities should not automatically be attributed to the Al Jazeera compromise. For organizations facing mercenary-spyware threats, recommended defenses include timely software updates, indicator hunting, device separation for high-risk activity, and travel-focused security briefings.
Get the actors, campaigns, and ATT&CK mapping behind it.
25 events from the most recent confirmed update back to the earliest known activity.
Discover-Tech's approved-vendor listings ended in October 2026. Google terminated its advertising-exchange access for systematic policy violations, while IAB Europe suspended it after an audit identified violations.
Insikt Group identified eight Candiru-linked operational clusters and assessed five as highly likely active at its June 26, 2025 analysis cutoff. The report also highlighted unresolved questions about advertising-based infection capabilities.
CTech reported a $30 million acquisition involving transfers of Candiru assets and employees to a newly established entity not then subject to US sanctions. Export-license transfers still required approvals.
The domain integrity-labs[.]ltd was registered. Insikt Group subsequently connected its WHOIS records to the Candiru alias Nerfwall.
Integrity Labs Ltd. was incorporated in Herzliya and directed by Naftali Yoran, reportedly also known as Elad Yoran. Insikt Group later identified it as a suspected corporate connection to Candiru.
Insikt Group found that an Indonesia-linked Candiru cluster appeared active until November 2024 and inactive afterward.
Daniel Freund reported a phishing attempt suspected to involve Candiru. He considered Hungary the most likely party behind the attempt.
At least 45 Al Jazeera devices were targeted during 2024 and 2025 through advertisements associated with Candiru spyware. The operation required no user interaction and selectively delivered attack code after screening device identifiers.
An unattributed Candiru cluster later identified by Insikt Group had been active since at least 2023. It likely administered victim-facing infrastructure directly through virtual private servers geolocated in Eastern Europe, potentially also using Tor.
Avast reported that Candiru exploited CVE-2022-2294 against Middle Eastern targets, including through a compromised Lebanese news-agency website.
The US Department of Commerce added Candiru and NSO Group to its Entity List for supplying spyware to foreign governments engaged in malicious activities.
Citizen Lab and Microsoft reported that Candiru spyware had compromised at least 100 people globally, including journalists, politicians, human rights defenders, and embassy personnel. Approximately half of Microsoft's observed victims were in Palestine.
Microsoft patched the vulnerability used in the April 2021 campaign targeting Armenian users.
A Candiru-linked campaign used Office documents to load Internet Explorer content through ActiveX objects or VBA macros. After fingerprinting targets, the documents delivered an exploit for CVE-2021-33742.
ESET uncovered activity affecting Middle East Eye, other Middle Eastern media outlets, an Iranian embassy website, aerospace firms, and Syrian and Yemeni government websites.
A Candiru infrastructure cluster later identified by Insikt Group had been active since at least 2020. Researchers assessed it as highly likely associated with a Saudi Arabia-based customer.
Discover-Tech was registered in Israel and appeared on Google and IAB Europe approved advertising-vendor lists beginning in 2020.
A Candiru infrastructure cluster later identified by Insikt Group had been active since at least 2019. Researchers assessed it as highly likely associated with a Hungary-based customer.
Eran Shorer and Yaakov Weizmann founded Candiru, the spyware vendor later operating as Saito Tech Ltd.
Citizen Lab's investigation reportedly identified Saudi Arabia's Ministry of Foreign Affairs as a target of the advertising-based spyware operation. The reference did not establish a successful compromise of ministry devices.
The researchers released infrastructure and file indicators for blocking and retrospective investigation, including mtrtb[.]com and the recovered spyware's SHA-256 hash. They also described the advertising-server-to-screening-server-to-command-and-control connection sequence defenders could investigate.
Beeswax removed Discover-Tech, Vungle paused its access pending review, and Eskimi blocked its accounts.
Citizen Lab found Discover-Tech callback code in advertisements appearing across approximately 75,000 mobile applications and 120,000 websites, including on sensitive institutional networks. Confiant found that advertisements directly connected to Candiru were low-volume and mainly reached residential and mobile connections; advertising exposure alone did not establish infection.
Citizen Lab linked the operation to Candiru with high confidence using distinctive techniques in the recovered spyware and identified Discover-Tech as the advertising supplier. Researchers described the first public technical confirmation of mercenary spyware reaching real devices through targeted advertisements, but did not recover the initial exploit or identify the responsible government.
Al Jazeera recovered a Windows program from a compromised device and supplied logs showing connections progressing from a Discover-Tech advertising server to a Candiru screening server and then a spyware command-and-control server.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
7 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcethehackernews.com
Open sourceheise.de
Open sourcenetzpolitik.org
Open sourcebloomberg.com
Open sourcecitizenlab.ca
Open sourceassets.recordedfuture.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citizen Lab and Confiant linked advertising operator Discover-Tech and its Controlium platform to large-scale identity collection and infrastructure supporting potential zero-click spyware delivery. An advertisement detected on April 12, 2026, led to infrastructure Citizen Lab attributed to Candiru, exposing an encrypted command-and-control framework capable of device fingerprinting, behavioral monitoring, and executing operator-supplied JavaScript. Discover-Tech also collected readable first-party cookies, including authenticated session identifiers and personal information, across more than 1,000 publisher domains, sometimes without GDPR consent. Researchers estimated its reach at 10 million daily ad impressions; exposed bidding records showed Discover-Tech-linked ads containing attacker script tags across more than 70,000 mobile apps and 120,000 websites between March and June. Researchers estimated that millions of devices were directed to Candiru servers for potential profiling, while Candiru-linked campaigns were smaller and geographically selective. Discover-Tech ad impressions reached government, military, international organization, and critical infrastructure networks, but **exposure does not establish targeting or compromise**, and not every advertisement was necessarily weaponized. Confiant did not capture a complete exploit chain. The findings echo ESET’s earlier investigation of Middle Eastern watering-hole campaigns that profiled visitors before selectively redirecting them toward suspected browser exploits; ESET assessed with medium confidence that those operators were Candiru customers. Limited visibility remains a major detection obstacle, with Al Jazeera network logs providing essential evidence for one attack. Defenders should prioritize browser and mobile patching, scrutinize advertising-origin script activity, and assess exposure of readable session cookies.
Oct 16, 2026
Citizen Lab and Microsoft exposed **Candiru**, an Israel-based mercenary spyware vendor also known as **Saito Tech Ltd.**, after investigators recovered a Windows malware sample dubbed **DevilsTongue** from a politically active victim in Western Europe. The investigation tied Candiru to a large surveillance operation that used more than **750 spoofed domains** masquerading as media outlets, advocacy groups, international organizations, and technology brands to lure targets and support spyware delivery. Microsoft said the operation exploited two Windows privilege-escalation zero-days, **`CVE-2021-31979`** and **`CVE-2021-33771`**, which it patched as part of its response. Researchers and Microsoft linked the activity to at least **100 victims** across countries including Palestine, Israel, Iran, Lebanon, Yemen, Spain, the United Kingdom, Turkey, Armenia, and Singapore, with journalists, dissidents, activists, politicians, and human rights defenders among those targeted; the infrastructure was also connected to the **CHAINSHOT** exploit kit and earlier Chrome and Microsoft Office zero-day exploitation.
Aug 15, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding a surge in sophisticated spyware campaigns targeting users of popular mobile messaging applications such as Signal, WhatsApp, and Telegram. Threat actors are leveraging commercial spyware and remote access trojans (RATs), employing tactics like social engineering, device-linking QR codes, zero-click exploits, and spoofed app versions to compromise high-value individuals, including government officials. Notable campaigns include the use of Android spyware like ProSpy, ToSpy, and ClayRat, as well as the exploitation of vulnerabilities in iOS, WhatsApp, and Samsung devices to deploy malware such as LANDFALL, with the goal of persistent access and data exfiltration. In a related development, researchers at Certo Software have identified a new Android RAT dubbed RadzaRat, which masquerades as a legitimate file manager app. RadzaRat provides attackers with full remote control over infected devices, supports large-scale file transfers, and features keylogging capabilities to steal sensitive information. Alarmingly, RadzaRat is currently undetectable by all major antivirus solutions and is openly available for download, increasing the risk of widespread abuse. These findings underscore the growing threat posed by advanced spyware and RATs targeting mobile platforms, often bypassing traditional security defenses and exploiting user trust in legitimate-looking applications.
Jun 29, 2026