The Al Jazeera AdFection Attacks: Technical Case Study

Overview

The Al Jazeera attacks are the central case study in Citizen Lab's October 2026 AdFection report. The investigation documents attacks against Al Jazeera during 2024 and 2025 and reports at least 45 Windows devices targeted in those attacks. Although ads also reached many Android/iOS apps — putting phones in the potential targeting pool — Citizen Lab's high-confidence forensic confirmation and the recovered sample came from Windows computers, not phones[1]. The case study is the first public technical confirmation that targeted advertising infrastructure was used to deliver mercenary spyware in the wild.

Initial discovery

Detection did not begin with conventional endpoint antivirus. Al Jazeera's in-house technology team noticed unusual patterns on devices used by some journalists and staff starting in 2024 and continuing into 2025, which prompted an internal probe. The team then contacted Citizen Lab, which conducted the deeper investigation[1]. Consistent with sophisticated mercenary spyware, the infections were not detected by endpoint antivirus in real time; they were identified through anomalous network traffic observed by the victim organization, followed by targeted log analysis and malware reverse-engineering.

Forensic chain

The exploit chain (historical & inferred)

6.1 The Candiru historical arsenal

Candiru has a proven history of procuring and weaponizing high-end browser and OS 0-days. The full documented set is in the CVE database; the categories most relevant to the inferred chain are:

• Internet Explorer (legacy/COM mode): CVE-2021-31979, CVE-2021-21166, CVE-2021-30551, CVE-2021-33742.
• Windows Kernel: CVE-2021-33771 (Kernel Object RCE).
• Chrome / WebRTC: CVE-2022-2294 (zero-day discovered by Avast).

6.2 The probable 2024–2026 kill-chain

Given that Al Jazeera's compromised machines were running Windows and communicating via Candiru C2, the reconstructed chain likely follows this pattern:

1. 01

   Browser context

   The victim is browsing in a legacy IE tab, Edge (using the MSHTML engine for compatibility), or Chrome.

2. 02

   DOM manipulation

   The malicious JS injects a crafted SVG or VML element into the DOM.

3. 03

   Type confusion / use-after-free

   The payload triggers a memory corruption bug in the rendering engine (e.g. WebKit, Blink, or MSHTML).

4. 04

   Code execution

   Execution is hijacked into the browser's renderer process.

5. 05

   Sandbox escape

   A secondary exploit (likely a Windows IPC bug or COM object vulnerability) escapes the browser sandbox into a higher-privilege process (e.g. chrome.exe, iexplore.exe, or a system service).

6. 06

   Kernel mode

   Candiru's DevilsTongue payload is injected into Ring 0 (kernel space) to establish anti-forensic footholds.

Recovered malware

A Windows DLL was recovered from a compromised device. Its publicly reported SHA-256 hash is shown below as a defensive indicator. The sample hard-coded the C2 domains fearevolve[.]com and jobmarcher[.]com[1].

Three lines of evidence

Citizen Lab's high-confidence attribution to Candiru rested on three converging lines of evidence[1,3].

1. 1 · Network-log analysis (temporal signature)

   Al Jazeera provided network logs covering the attack period. Infected devices showed a consistent sequence: contact with Discover-Tech infrastructure (an ad impression), seconds later a connection to a Candiru validator server, and within 1–3 minutes contact with a Candiru C2 server. This temporal signature linked the ad delivery directly to the spyware infection.

2. 2 · Infrastructure fingerprinting

   Researchers developed HTTP fingerprints for Candiru servers (a "V1" fingerprint for validator servers such as keyadapter[.]com and sharethere[.]net), matching specific HTTP response banners observed on Censys against previously known and newly identified Candiru infrastructure.

3. 3 · Recovered malware sample

   Al Jazeera isolated a Windows DLL (SHA-256 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8). Analysis showed it was a newer build of the Candiru chain Citizen Lab exposed in 2021, matching on COM hijacking for persistence, a 48-byte repeating XOR string-obfuscation scheme with a dummy null-terminator, hardcoded C2 domains (fearevolve[.]com, jobmarcher[.]com), and network connectivity checks against Google and Microsoft.

What the malware did

Citizen Lab assessed the recovered Windows DLL as a newer build of the Candiru chain it exposed in 2021 (DevilsTongue / SOURGUM), matching on distinctive traits — COM-hijacking persistence, 48-byte XOR string obfuscation, hardcoded C2, and Google/Microsoft connectivity checks. It did not publish a full new reverse-engineering of the exact 2024–2025 payload's behavior; the capabilities below reflect the established Candiru Windows implant from Citizen Lab, Microsoft, and related analyses, not a fresh teardown of this specific sample[1,3].

Once installed, that implant is designed for deep, persistent surveillance and data theft: file and document exfiltration; browser data theft (cookies, saved credentials, bookmarks, and history from Chrome, Firefox, and other browsers); messaging and account access (including Signal Desktop data, and using stolen cookies/sessions to access or impersonate accounts on platforms such as Gmail and Facebook, including sending messages from logged-in accounts); credential dumping from memory (e.g., LSASS) and browsers; surveillance features (screenshots, keystrokes, microphone and webcam activation); and remote control / command execution (registry queries, WMI commands, and further operator control), protected by encrypted C2, in-memory execution, and unique build hashing[3].

Al Jazeera's own description of the incident characterized the spyware as collecting files, documents, browser data (cookies, bookmarks, credentials), keystrokes, screenshots, microphone/webcam input, and emails and messages from communication platforms. The specific data extracted in the Al Jazeera cases has not been publicly detailed beyond these general capabilities of the Candiru implant[1].

What remains unknown

• ›The complete exploit chain used in the documented compromises.
• ›Whether a newly undisclosed zero-day was involved.
• ›The full extent of mobile compromise.
• ›The precise number of devices successfully compromised versus targeted.
• ›The operator(s) of the individual campaigns.
• ›The governments behind the Al Jazeera targeting were not identified in the report.