Candiru hit 45 Al Jazeera devices through 2024 and 2025

At least 45 devices at the news network Al Jazeera were targeted in Candiru zero-click attacks across 2024 and 2025, and the delivery vector was online advertising. The Citizen Lab links the attacks to Candiru with high confidence and calls the technique AdFection: a targeted ad renders on a device, and that alone is enough to start an infection chain. No tap, no click, in some cases no visible ad at all because it can render in the background. This is the first public technical confirmation that mercenary spyware is being distributed through targeted ads.

The pipeline runs through Discover-Tech, an Israeli company that presents itself as an advertising vendor. It appeared on Google’s and IAB Europe’s lists of certified or approved ad vendors from 2020 until early October 2026, served ads via Google, Yandex, and Beeswax, and used GDPR consent frameworks to reach users inside the EU. Both Google and IAB Europe removed it from their registries after the investigation, and Google terminated its ad exchange access. Beeswax, Vungle (Liftoff), and Eskimi also cut it off.

How the delivery works

Real-time bidding is the mechanism being abused, and nothing about it is exotic. When a page or app shows an ad, the device sends a bid request carrying device identifiers, IP address, and often precise location; advertisers bid; the exchange pushes the winning ad. Two properties of that system make it a weapon. The bid request lets a buyer target a single individual by mobile advertising ID, cookie ID, or IP. And an ad is not just an image, it can carry HTML and JavaScript that runs in the app or browser, which can fetch further code.

Discover-Tech’s ads carry a script tag pointing to what the company calls a NOAS server, or getAd server. When the ad renders, that tag connects back to Discover-Tech, submits the user’s cookie ID or mobile ad ID, and executes whatever JavaScript the server returns. The server decides eligibility from the source IP and the advertising identifier. A target gets code; everyone else gets a 0-byte response. That design keeps the malicious payload, and even pointers to it, out of the hands of the exchanges and ad networks that serve the ads. Google’s and IAB Europe’s vetting had nothing malicious to inspect because the decision to deliver happens on Discover-Tech’s own infrastructure, after the ad is already approved and in flight.

Even devices that are not selected still leak. The non-targeted ad gathers cookies set on the page and the device’s public IPv6 address and sends them back. Across a four-month window, four billion bidding records show Discover-Tech ads served on nearly 200,000 distinct Android apps, iOS apps, and websites in dozens of countries, and covertly steering millions of devices to contact Candiru’s servers, likely for tracking and reconnaissance.

The infection chain and how it was caught

Al Jazeera’s network logs gave the attack a clean temporal signature. An infected device first contacts Discover-Tech infrastructure, which marks the ad impression. Next it reaches a Candiru validator server, which checks the device before further profiling. Finally it talks to a Candiru command-and-control server. That ordering is the detection opportunity for anyone with egress logs.

The Citizen Lab built Censys fingerprints for both tiers. Fingerprint V1 matched validator servers including keyadapter[.]com and sharethere[.]net, turning up 305 domains on 319 IPs between August 2022 and July 2026, with the behaviour retired through May and June 2026. Fingerprint C1 matched four C&C servers: fearevolve[.]com, insightenterprisells[.]com, jobmarcher[.]com, and plasticbells[.]com. Al Jazeera pulled a Windows DLL (SHA256 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8) from a compromised device that hardcodes fearevolve[.]com and jobmarcher[.]com. It matches the 2021 Candiru chain on COM-hijack persistence, a 48-byte repeating XOR key for string obfuscation (with a dummy null terminator that is allocated but never deobfuscated), and a hardcoded connectivity check against www.google.com and www.microsoft.com.

Controlium

The targeting itself runs through a control panel called Controlium. Discover-Tech shipped the entire frontend source on the app’s login page, so the researchers reconstructed the UI. Operators pick a target by iOS or Android advertising identifier, MyDSP or Beeswax cookie ID, or IP address, then push a “controlled ad” that delivers the payload. Some controlled ads wore the branding of Amazon or AliExpress, with no evidence those firms bought them. Admin accounts can white-label the panel, restrict access to specific IPs, and apply OpSec restrictions on bidding. The researchers also pulled login records from an unauthenticated API endpoint and assessed that a valid authorization token could be spoofed, though they did not test it. One endpoint, /jsConfig, returns the string ONLY DEKEL IS ALLOWED!!!, a likely nod to CEO Dekel Boni.

For anyone defending high-risk users, the practical takeaways are narrow but concrete. Ad-vendor certification is not a signal of safety here, because the payload decision lives outside the ad system. Detection has to come from the network: the impression-then-validator-then-C&C sequence, plus the published V1 and C1 fingerprints and the named domains, are what caught this. Discover-Tech’s reach also goes beyond Candiru, with links to the mercenary hacking firm Bindecy, the ADINT vendor Intelos, and a separate actor the Citizen Lab calls DARK CARTOGRAPHER, which is using the same infrastructure to exploit mobile carriers and tie advertising IDs to phone numbers.