Candiru & AdFection Research Timeline: 2014–2026

Early corporate antecedents of the company later known publicly as Candiru.

Citizen Lab publishes the first public technical exposure of the Candiru spyware vendor.

Microsoft Threat Intelligence publishes technical analysis of the DevilsTongue Windows implant and SOURGUM actor.

Multiple zero-day vulnerabilities associated with Candiru activity patched across Windows and Chrome.

U.S. Department of Commerce adds Candiru (Saito Tech) to the Entity List.

Candiru targeting reported in investigations involving Catalan civil society.

Avast documents Candiru-linked exploitation of a Chrome/Android V8 heap buffer overflow.

AdFection attacks against Al Jazeera documented by Citizen Lab.

Recorded Future / Insikt Group publishes infrastructure intelligence and identifies the Integrity Labs corporate identity.

Amnesty International documents Intellexa's advertising-based 'Aladdin' delivery concept.

Citizen Lab notes Candiru V1 validator fingerprinting behavior begins disappearing during May–June 2026.

Citizen Lab documents AdFection — targeted advertising as a Candiru delivery pipeline — and the Al Jazeera attacks.