ASSESSED// Citizen Lab 2026v1.0
AdFection vs Intellexa Aladdin: Comparative Analysis of Advertising-Based Spyware Delivery
Amnesty International published detailed research in December 2025 concerning Intellexa's advertising-based 'Aladdin' delivery concept. Citizen Lab's October 2026 AdFection research represents publicly documented technical confirmation of in-the-wild targeted-ad delivery linked to Candiru. This page compares the two.
- Published
- 2026-10-15
- Last reviewed
- 2026-10-18
- Last updated
- 2026-10-18
- Evidence
- ASSESSED
Key distinction
Amnesty International's December 2025 research documented Intellexa's advertising-based "Aladdin" delivery concept/capability. Citizen Lab's October 2026 AdFection research represents publicly documented technical confirmation of in-the-wild targeted-ad delivery linked to Candiru. Aladdin is a documented concept; AdFection is documented in the wild.
Comparison
| Dimension | AdFection (Candiru) | Aladdin (Intellexa) |
|---|---|---|
| Vendor | Candiru (Integrity Labs) | Intellexa |
| Spyware | DevilsTongue (Windows) | Predator |
| Research source | Citizen Lab (2026) | Amnesty International (2025) |
| Year | 2026 | 2025 |
| Advertising ecosystem role | Discover-Tech / Controlium delivery | 'Aladdin' advertising-based delivery concept |
| Zero-click-like behavior | Documented in the wild | Concept/capability documented |
| Public evidence | Recovered malware + infrastructure | Research publication |
| Confirmed victims | Al Jazeera (45+ devices targeted) | Documented in Amnesty research |
Known unknowns
- • The extent to which other commercial spyware vendors use equivalent advertising-based delivery.
- • Whether Aladdin-style delivery has been used in the wild beyond documented cases.
- • The full set of advertising ecosystems leveraged across vendors.
Last updated 2026-10-18
