DevilsTongue Spyware: Complete Technical Analysis of Candiru's Windows Implant
DevilsTongue is the name Microsoft assigned to sophisticated modular Windows spyware associated with the Israeli commercial surveillance vendor commonly known as Candiru. It is a C/C++ multi-threaded, multi-stage implant with encrypted in-memory components, COM-hijacking persistence, user-mode and kernel-mode capability, and extensive credential, browser, file, and messaging data collection.
- Published
- 2026-10-15
- Last reviewed
- 2026-10-18
- Last updated
- 2026-10-18
- Evidence
- CONFIRMED
Discovery & naming
DevilsTongue was named by Microsoft Threat Intelligence in July 2021 as part of its analysis of the mercenary spyware market. Microsoft assigned the threat-actor designation SOURGUM to the operator — the company publicly known as Candiru. Citizen Lab's parallel "Hooking Candiru" research independently exposed the vendor. DevilsTongue refers specifically to the Windows implant; Candiru refers to the vendor; SOURGUM is Microsoft's actor designation. These are related but not identical entities. Subsequent research by Google TAG, ESET, and Avast further documented Candiru activity and exploits, and Candiru marketed a claimed multi-platform zero-click vector called "Sherlock".
Architecture
DevilsTongue is a modular, multi-stage C/C++ implant. Its architecture separates a loader/persistence stage from encrypted functional components that are decrypted and loaded into memory at runtime. Second-stage payloads and configuration are stored encrypted on disk (AES-256-CBC in the 2021 samples) in resource sections or configuration directories (e.g., undersystem32\config\spp\...), and decrypted and executed only in memory. This design reduces the forensic footprint on disk and complicates static analysis. Each build is produced with unique hashes, and timestamp/PDB paths are scrubbed. PE headers and strings are obfuscated, reducing the value of simple hash-based detection. Strings are protected by a distinctive 48-byte XOR obfuscation scheme using a dummy null-terminator.
Device is exposed to the delivery chain; in AdFection, via targeted advertising infrastructure.
COM-hijacking-based persistence and a loader stage establish a foothold on the Windows host.
Modular components are stored encrypted on disk and decrypted only in memory.
Components are loaded into memory without touching disk as standalone files, reducing forensic footprint.
Credential, browser, file, and messaging data collection runs in user mode.
Historical versions interacted with the kernel, including documented signed-driver abuse.
Collected data is staged and prepared for exfiltration.
The implant communicates with Candiru command-and-control infrastructure for tasking and exfiltration.
Capabilities
The capabilities below are organized by defensive ATT&CK-style categories. Full per-technique detail, evidence sources, and detection ideas are on the capabilities page.
- ›LSASS credential access
- ›Browser-stored credentials
- ›Impersonation via stolen cookies/sessions
- ›Sending messages from logged-in accounts
- ›File & document exfiltration
- ›Browser history, cookies, bookmarks & credentials (Chrome, Firefox, SQLite)
- ›Signal Desktop data
- ›Screenshots
- ›Keystrokes
- ›Webcam & microphone activation
- ›COM hijacking
- ›String encryption
- ›Timestamp/PDB scrubbing
- ›In-memory decryption
- ›Unique builds/hashes
- ›Encrypted C2 communication
- ›Tasking & collection
- ›Registry queries
- ›WMI commands
- ›Network connectivity checks
Persistence: COM hijacking
DevilsTongue's documented persistence mechanism is COM object hijacking — abusing legitimate COM registry entries so that the implant's code is loaded by trusted processes. This is stealthier than traditional Run-key or service persistence because it abuses existing, legitimate system infrastructure rather than creating obvious new artifacts. The 2024–2025 Al Jazeera sample matched this same approach, alongside the same 48-byte XOR obfuscation style.
A first-stage DLL is dropped into a legitimate-looking system directory, typically under the Japanese Input Method Editor pathC:\Windows\system32\ime\IMEJP\IMJPUEXP.DLL(or a similar location under system32\IME). This folder exists on default Windows installs, but the specific filename is not a real Windows component.
The malware overwrites a legitimate COM class registry key so Windows loads the malicious DLL instead of the real one. The classic key used in 2021 wasHKLM\Software\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32. Normally this points to wmiutils.dll (part of Windows Management Instrumentation). After the hijack it points to the malicious DLL.
When Windows starts the WMI service (or related COM activity), it looks up that CLSID and loads the DLL path from the registry. This loads the spyware into a svchost.exe process, often with SYSTEM privileges, without needing a traditional Run key, scheduled task, or startup folder entry.
A pure hijack would break the original COM object and could cause visible system problems. Candiru's code avoids this: in DllMain it calls LoadLibrary on the real original DLL so the legitimate component still loads, then uses shellcode to manipulate the return address of LoadLibraryExW so the system believes the legitimate DLL was loaded normally. The malware's own code runs, but system functionality continues, reducing the chance of user-noticeable breakage or investigation.
COM hijacking is one of several Windows persistence mechanisms — alongside Run/RunOnce keys, Winlogon values, scheduled tasks, services, DLL side-loading, startup folders, and kernel drivers. It is among the stealthier options: it abuses existing legitimate infrastructure rather than creating obvious new artifacts, and the LoadLibraryExW stability trick avoids visible system breakage. Sophisticated actors, including commercial spyware vendors, frequently combine several mechanisms — COM hijacking for the main implant plus a scheduled task or service as a secondary fallback — while minimizing on-disk artifacts by executing the bulk of their code in memory.
Defensive detection guidance is on the detection page.
Browser & messaging data
DevilsTongue collects browser data — cookies, history, and credentials — by reading the SQLite databases used by major browsers. It also targets Signal Desktop data, extracting messaging material from the desktop client's local storage. These capabilities are described for defensive understanding only.
Kernel interaction
Historical versions of DevilsTongue interacted with the Windows kernel, including documented abuse of a signed third-party driver —physmem.sys ("Physical Memory Access Driver"), dropped toC:\Windows\system32\drivers\ — to gain kernel-level capability. The driver is abused for kernel-level memory access and to proxy certain API calls (e.g., process creation, memory writes), which helps evade user-mode detection and can make activity appear to come from other processes. Defensive monitoring of driver loading is covered on the detection page.
Kernel-mode capabilities
Once running with kernel access via the signed-driver abuse, DevilsTongue establishes deep, hard-to-detect footholds:
Modifies the EPROCESS structure in kernel memory to hide the implant's PID from standard tools like Task Manager.
Overwrites the memory space of legitimate, signed processes (e.g. svchost.exe, SearchIndexer.exe) with malicious code.
Hooks standard Windows kernel debug registers to detect sandboxes or reverse-engineering environments.
User-mode exfiltration modules
In user mode, DevilsTongue runs modular exfiltration components:
Steals NTLM/LM hashes, browser cookies, and saved Wi-Fi credentials.
Specifically targets Signal Desktop, corporate email clients, and social media apps to capture end-to-end encrypted messages before they are encrypted (plaintext memory scraping).
Stages and compresses target directories for exfiltration.
Command & control
DevilsTongue communicates with Candiru C2 infrastructure to receive tasking and exfiltrate collected data. The C2 layer is separated from infection infrastructure for operational security. In the 2026 AdFection investigation, C2 domains hard-coded in the recovered sample included fearevolve[.]com and jobmarcher[.]com. See the C2 page.
Relationship to AdFection
The 2026 AdFection report recovered a Windows DLL attributed to Candiru through functional and structural overlap with earlier DevilsTongue samples — including COM-based persistence, distinctive string obfuscation, network connectivity checks, and overall functional overlap. Citizen Lab did not publish a full new reverse-engineering of the exact 2024–2025 payload's behavior; the capabilities described here reflect the established Candiru Windows implant, not a fresh teardown of the recovered sample. AdFection describes the delivery pipeline; DevilsTongue describes the implant. They are related but not the same thing.
Detection
Do not rely exclusively on hashes. Sophisticated spyware evolves, and unique builds defeat static hash-based detection. Behavioral detection — COM persistence artifacts, unusual DLL loading, browser-to-process transitions, credential-access telemetry, and C2 hunting — is more durable. See the detection page and IOC guide.
- [1] Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware — Citizen Lab, 2026-10-15
- [2] Hooking Candiru: An Analysis of a New Israeli Spyware Vendor — Citizen Lab, 2021-07-15
- [3] DevilsTongue: A New Market for Mercenary Spyware — Microsoft Threat Intelligence, 2021-07-13
- [4] Google TAG research on Candiru zero-day campaigns — Google Threat Analysis Group, 2021
- [5] Return of Candiru (CVE-2022-2294) — Avast / Gen Digital Threat Labs, 2022-07
- [6] Tracking Candiru's DevilsTongue Spyware in Multiple Countries — Recorded Future / Insikt Group, 2025
- [7] ADINT / weaponized ad-tech investigation — Confiant Threat Intelligence, 2026
- [8] Intellexa 'Aladdin' advertising-based spyware delivery research — Amnesty International Security Lab, 2025-12
- [9] Candiru Entity List announcement — U.S. Department of Commerce, Bureau of Industry and Security, 2021-11-03
- [10] CVE entries for Candiru-associated vulnerabilities — NIST National Vulnerability Database, 2021-2022
- [11] ESET research on Candiru / DevilsTongue activity — ESET, 2021-2022
