AdFection Detection and Defense: Protecting Organizations From Ad-Delivered Zero-Click Spyware
Citizen Lab's central defensive recommendation is that organizations handling high-risk personnel should consider blocking advertising and tracking at devices and organizational gateways. Practical measures include DNS filtering, secure web gateways, browser isolation, MDM advertising-ID controls, and endpoint telemetry tuned to Candiru behavioral indicators.
- Published
- 2026-10-15
- Last reviewed
- 2026-10-18
- Last updated
- 2026-10-18
- Evidence
- CONFIRMED
Core recommendation
Organizations handling high-risk personnel should consider blocking advertising and tracking at devices and organizational gateways. This reduces the attack surface presented by programmatic advertising infrastructure without relying on detecting the payload itself.
Practical measures
Block advertising and tracking domains at organizational gateways to reduce the attack surface.
Filter DNS for known advertising, tracking, and threat infrastructure.
Remote browser isolation separates ad execution from the endpoint.
Inspect and control web traffic for advertising-delivered script behavior.
Restrict advertising identifiers and reset them periodically on managed devices.
Tune EDR to COM persistence, DLL loading anomalies, and credential access.
Hunt for documented C2 and validator indicators in historical logs.
High-risk environments
Industry response
Google told Citizen Lab that it terminated Discover-Tech's access to its advertising exchanges and deployed Safe Browsing protection against known actor-controlled domains. Eskimi also took enforcement action against the suspicious loaders it identified. The architecture, however, is replicable; enforcement against one operator does not remove the underlying attack surface.
SOC detection
For endpoint detection of Candiru/DevilsTongue, see the DevilsTongue detection page. Do not rely exclusively on hashes; behavioral detection is more durable.
Last updated 2026-10-18
