bleeping-computer Oct 16, 2026 · Crawled Oct 17, 2026

Targeted ads installed Candiru spyware in zero-click attacks

3 IoCs 1 Actors 1 Malware

AI Summary

Candiru spyware was delivered via a zero-click attack technique dubbed AdFection, in which malicious JavaScript was embedded in targeted online advertisements served through Discover-Tech's Controlium platform. The attack targeted devices at Al Jazeera Media Network and others, with evidence showing that at least 45 devices were targeted between 2024 and 2025. The malicious ads contacted Discover-Tech's NOAS server, which selectively delivered exploit code to specific devices based on identifiers like IP address, leading to infections linked to Candiru command-and-control infrastructure. A DLL file recovered from a compromised Windows system was attributed to Candiru with high confidence.

AI-extracted · verify before operational use

Extracted Entities 2 found

Threat Actor Caramel Tsunami → Malware DevilsTongue →

Indicators of Compromise 3 extracted

Type	Value	Detail
Domain	noas[.]discover-tech[.]com	Details →
Domain	getad[.]discover-tech[.]com	Details →
Filename	DevilsTongue.dll	Details →

MITRE ATT&CK TTPs 5 techniques

T1059.001 PowerShell · Execution T1071.001 Web Protocols · Command And Control T1090 Proxy · Command And Control T1189 Drive-by Compromise · Initial Access T1204.002 Malicious File · Execution