AdFection & Candiru Spyware: Frequently Asked Questions

AdFection is the name Citizen Lab gave to a zero-click mercenary-spyware delivery technique first publicly documented in October 2026. It uses targeted online advertising infrastructure to identify selected devices and route them toward Candiru spyware infection infrastructure. AdFection is a delivery and targeting methodology, not a piece of malware itself.

AdFection was discovered and named by the Citizen Lab (University of Toronto's Munk School) in a report published October 15, 2026 (Report 195). The investigation documented attacks during 2024 and 2025 and linked the delivery infrastructure to the Candiru spyware vendor.

AdFection was publicly disclosed on October 15, 2026, in Citizen Lab Report 195. The underlying attacks it documents took place during 2024 and 2025.

No. AdFection is not malware. It is a delivery and targeting pipeline that uses programmatic advertising to reach selected devices. The spyware delivered through that pipeline is attributed to Candiru, including its Windows implant known as DevilsTongue.

No. AdFection is the delivery technique; Candiru is the spyware vendor whose implant is delivered through it. The two are linked because Citizen Lab attributed the spyware recovered in the AdFection investigation to Candiru, but they are distinct concepts.

AdFection is significant because it demonstrates a convergence of commercial advertising technology and mercenary surveillance: the same programmatic-ad infrastructure used to serve everyday ads was repurposed to profile, select, and attempt to compromise specific individuals at scale, without requiring the target to click anything.

The AdFection investigation was published by Citizen Lab. Earlier elements of the Candiru ecosystem were independently corroborated by Microsoft Threat Intelligence (2021), Google Threat Analysis Group (2021), and Avast/Gen Digital (2022), and Recorded Future reported on Candiru infrastructure and the Integrity Labs corporate identity in 2025.

An ad creative can contain a reference to a remote script endpoint. When the ad renders inside a webpage or app, the viewing device connects to that endpoint. For selected targets, the endpoint can return additional code that routes the device toward validator and exploit infrastructure, rather than a normal ad payload.

No. AdFection is described as zero-click delivery. The ad creative and its script references execute as part of normal ad rendering in the browser or in-app webview; the target does not need to click or interact with the advertisement.

Zero-click means the target takes no action — no click, no download, no permission grant — for the delivery to proceed. AdFection qualifies as zero-click at the delivery stage because the ad renders automatically and its script reference fires without user interaction. Whether a full exploit chain then succeeds without interaction depends on the specific vulnerability used.

A validator is infrastructure that profiles and confirms a target's eligibility before an exploit stage is attempted. Citizen Lab identified 305 validator-associated domains across 319 IP addresses matching its V1 fingerprint. Validators help operators avoid wasting scarce zero-day exploits on non-targets or security-research devices.

Targeting uses advertising-ecosystem identifiers — mobile advertising IDs (IDFA/AAID), cookie identifiers, and IP addresses — handled by a targeting and control platform associated with the ad infrastructure. The operator specifies selector values; only devices matching those selectors are routed toward the exploit path when they encounter a relevant ad.

Non-targeted devices that render the same ad creative are not routed to the exploit path. The remote script endpoint selectively returns the exploit-routing code only to devices matching the operator's targeting selectors; other devices receive a normal ad response or nothing actionable.

All three. The associated targeting platform supports selection by mobile advertising ID, cookie identifier, and IP address. This lets operators aim at a specific person's device across apps and websites rather than only at a network location.

An ad impression is simply an ad rendering on a device. Profiling uses ad-tech data to learn about devices. Target selection is the operator choosing specific devices via selectors. Compromise is a successful exploit and implant execution. Seeing a targeted ad, or even being profiled or selected, does not mean a device was compromised — these are distinct stages, and conflating them is a common error.

Candiru is an Israel-based mercenary spyware vendor that sells surveillance capabilities to government customers. It was first publicly exposed by Citizen Lab in July 2021. Its Windows implant is named DevilsTongue by Microsoft.

Candiru is an Israeli company. Citizen Lab and subsequent reporting place it in Israel's commercial spyware sector. It was added to the U.S. Entity List in November 2021 under the name Saito Tech.

Saito Tech is a corporate name associated with Candiru. The U.S. Department of Commerce added Candiru (Saito Tech) to the Entity List in November 2021, tying the public 'Candiru' designation to the Saito Tech corporate identity.

Integrity Labs is a corporate identity associated with Candiru, identified by Recorded Future in 2025 and discussed in Citizen Lab's 2026 report. Its acquisition status involving Integrity Partners is not fully resolved in public sources.

DevilsTongue is the name Microsoft Threat Intelligence assigned to sophisticated modular Windows spyware associated with Candiru. Microsoft disclosed it in July 2021 alongside Citizen Lab's parallel 'Hooking Candiru' research, and referred to the actor as SOURGUM.

Microsoft Threat Intelligence named DevilsTongue and disclosed it on July 13, 2021, referring to the Candiru actor as SOURGUM. Citizen Lab published its 'Hooking Candiru' analysis two days later, on July 15, 2021.

Windows is the most prominently documented platform for DevilsTongue. Other platform capabilities are described in source material according to source strength; the complete cross-platform exploit chain has not been fully established in public reporting.

DevilsTongue is modular spyware capable of persistence, data collection, credential access, and command-and-control communication. Documented capability categories include file access, credential theft, browser data exfiltration, and kernel-level interaction. Exact capabilities vary by module configuration.

DevilsTongue uses persistence mechanisms including COM (Component Object Model) object hijacking, which allows it to survive reboots without a traditional startup entry. Behavioral detection of unusual COM persistence is a recommended detection approach.

DevilsTongue communicates with command-and-control (C2) infrastructure using encrypted channels and legitimate-looking domains. C2 traffic is designed to blend with normal web traffic. C2 hunting and behavioral detection are recommended over relying solely on static indicators.

Discover-Tech is the advertising-technology company identified in the 2026 AdFection investigation as operating infrastructure in the targeted-ad delivery path. It is associated with a set of ad-tech platforms and reported connections to Candiru.

Controlium is the targeting and control platform associated with Discover-Tech. It supports targeting by mobile advertising ID, cookie identifier, and IP address, enabling selective delivery of ad-based payloads to chosen devices.

ADINT stands for Advertising Intelligence — the use of advertising-ecosystem data and infrastructure for intelligence and surveillance purposes. It repurposes the same data and delivery pipes used for normal ad targeting to profile, locate, and attempt to compromise selected individuals.

Traditional signals intelligence intercepts communications or emissions. ADINT instead leverages the commercial advertising ecosystem — ad exchanges, bid streams, advertising IDs, and cookies — which already collects rich device and location data at global scale. The attacker rents existing ad-targeting capability rather than building interception infrastructure.

Controlium supports targeting by mobile advertising ID (such as Apple's IDFA or Google's AAID), cookie identifier, and IP address. These selectors let an operator aim at a specific device across many apps and websites rather than a single network location.

Citizen Lab identified Discover-Tech as operating infrastructure in the targeted-ad delivery path. Some third-party claims about Discover-Tech go beyond what primary sources establish; this site distinguishes reported findings from allegations and labels confidence accordingly.

The 2026 AdFection investigation reported a connection between Discover-Tech's ad infrastructure and Candiru spyware delivery. The precise corporate and operational relationship is treated according to source strength; readers should distinguish confirmed infrastructure findings from broader allegations.

Citizen Lab documented a series of attacks against Al Jazeera staff during 2024 and 2025 in which targeted advertising infrastructure was used to attempt delivery of Candiru spyware. The investigation recovered a Windows DLL attributed to Candiru from an affected device.

The attacks documented in the AdFection investigation took place during 2024 and 2025, and were reported publicly on October 15, 2026.

At least 45 devices were reported targeted in the Al Jazeera attack series. It is important to distinguish 'targeted' from 'compromised' — being targeted means a device was selected for an attempt, not that the attempt succeeded.

No. 'Targeted' does not equal 'compromised.' Targeting means a device was selected for a delivery attempt; compromise requires the full exploit chain to succeed. The research does not establish that every targeted device was fully compromised.

Citizen Lab recovered a Windows DLL attributed to Candiru from an affected device in the Al Jazeera case. This artifact was a key piece of evidence linking the AdFection delivery infrastructure to the Candiru spyware vendor.

The link was established through forensic analysis of recovered malware (a Windows DLL attributed to Candiru), combined with infrastructure analysis of the validator and delivery domains. The convergence of the delivery path and the Candiru-attributed artifact supported the attribution.

No. The research reported that relevant advertisements appeared on 120,768 websites. That means ads associated with the campaign were displayed on those sites; it is not equivalent to those websites being compromised or their operators being complicit.

No. Ads containing attacker-related script tags were reportedly displayed through 75,373 apps. This does not mean the apps were malicious or that their publishers were complicit; the ad was delivered through the apps' normal ad inventory, not by altering the apps themselves.

Citizen Lab identified 305 validator-associated domains across 319 IP addresses matching its V1 fingerprint. These validators profile and confirm targets before an exploit attempt.

The campaign's ads appeared on a very large number of websites and apps, but targeted delivery attempts were selective — aimed at specific devices matching operator selectors. Wide ad distribution and narrow target selection are both part of the model: broad reach enables precise selection.

CVEs publicly associated with Candiru activity include CVE-2021-31979, CVE-2021-33771, CVE-2021-21166, CVE-2021-30551, CVE-2021-33742, and CVE-2022-2294. These span Windows, Chrome, and Android components and were disclosed between 2021 and 2022.

CVE-2021-31979 is a Windows kernel elevation-of-privilege vulnerability disclosed in 2021 and associated with Candiru activity. It was patched by Microsoft. It represents one of the documented privilege-escalation links in Candiru's exploit chain.

CVE-2021-33771 is a Windows kernel elevation-of-privilege vulnerability disclosed in 2021 and associated with Candiru. It was patched by Microsoft. Together with CVE-2021-31979 it illustrates Candiru's use of kernel privilege-escalation primitives.

CVE-2022-2294 is a Chrome / Android V8 heap buffer overflow vulnerability disclosed in July 2022 and linked to Candiru by Avast and Gen Digital Threat Labs. It demonstrated that Candiru-related exploitation activity continued after the 2021 disclosures.

No. The AdFection report did not disclose a brand-new zero-day vulnerability. Do not state that a newly disclosed zero-day was involved unless new forensic evidence establishes it. The significance of AdFection is the delivery method, not a new vulnerability.

The CVEs listed above have been patched by their respective vendors (Microsoft, Google/Android). Patch status for each entry is tracked in the CVE database. Applying vendor patches remains the baseline defense, though mercenary actors continually seek new flaws.

Individuals can reduce risk by limiting ad and tracker exposure: use a reputable ad blocker or privacy browser, reset or limit mobile advertising IDs in device settings, and keep operating systems and browsers fully patched. These reduce the attack surface presented by programmatic advertising.

Yes. Reducing ad and tracker exposure reduces the attack surface presented by programmatic advertising infrastructure, since AdFection depends on ads rendering and contacting remote script endpoints. Ad blocking is a useful layer of defense, though not a complete guarantee on its own.

Enterprises should block advertising and tracking at devices and organizational gateways using DNS filtering, secure web gateways, and browser isolation; enforce MDM controls that reset or restrict advertising IDs; maintain endpoint telemetry; and keep all systems patched. Defense in depth is essential because no single control fully eliminates ad-delivered risk.

SOC teams should focus on behavioral detection: COM-object persistence anomalies, unusual DLL loading, browser-to-process transitions, credential-access telemetry, and C2 hunting. Do not rely exclusively on file hashes, because mercenary implants are individually compiled and hashes change per target.

Hash-based detection alone is unreliable for DevilsTongue because mercenary spyware is typically compiled uniquely per target. Behavioral detection — persistence mechanisms, process injection, credential access, and C2 patterns — is more effective than static hashes.

DNS filtering blocks requests to known malicious or advertising domains at the network level. It helps by preventing devices from resolving validator and exploit-delivery domains, reducing the chance that a rendered ad can reach the exploit path.

Browser isolation runs web browsing in a remote, disposable container rather than on the user's device. It helps against ad-delivered threats because any malicious code executes in the isolated environment and does not reach the endpoint directly.

Yes. Candiru (Saito Tech) was added to the U.S. Department of Commerce Entity List on November 3, 2021, restricting the export of U.S.-origin items to it.

The U.S. Department of Commerce cited Candiru's role in supplying spyware used to surveil dissidents, journalists, academics, and others, determining that such activity was contrary to U.S. national security and foreign policy interests.

Candiru sells surveillance capabilities to government customers. Public reporting and the U.S. Entity List action reference its use by state actors against journalists, dissidents, and others. Specific customer identities are treated according to source strength.

Legality depends on jurisdiction and the user's authority. Mercenary spyware use against journalists, dissidents, and civilians without due process is widely condemned and, in many jurisdictions, illegal. The U.S. Entity List and related export controls restrict transactions with Candiru. This site does not provide legal advice.

NSO Group is another Israel-based mercenary spyware vendor, known for the Pegasus mobile implant. Candiru is a separate vendor whose Windows implant (DevilsTongue) and ad-based delivery (AdFection) are distinct from NSO's Pegasus, though both operate in the commercial spyware market and have faced scrutiny over misuse.

Public reporting documents the use of Candiru spyware against journalists, dissidents, and others, and the U.S. added Candiru to the Entity List in 2021. Specific prosecutions of operators or customers are not established in the primary sources cited here; this site does not claim prosecutions it cannot substantiate.

No. Seeing a targeted ad, or even being profiled or selected as a target, does not mean your device is compromised. Compromise requires the full exploit chain to succeed. Ad impression, profiling, target selection, and compromise are distinct stages.

No. The figure refers to the number of websites on which relevant advertisements appeared, not to websites being hacked. The ads were delivered through normal programmatic ad inventory; the websites themselves were not necessarily compromised.

AdFection is a delivery technique, not a specific iOS exploit. The complete iOS exploit chain has not been publicly established. Do not assume iOS compromise without forensic evidence. Windows compromise is the most prominently documented outcome.

No. The AdFection report did not disclose a new zero-day. Its significance is the advertising-based delivery method and the targeting infrastructure, not a newly discovered vulnerability. Stating otherwise misrepresents the research.

No. AdFection relied on specific advertising infrastructure associated with the identified ad-tech platforms. The vast majority of ad networks and publishers are not implicated; the campaign exploited particular delivery paths, not the entire advertising industry.

Intellexa is a mercenary surveillance vendor whose 'Aladdin' concept for advertising-based spyware delivery was documented by Amnesty International's Security Lab in December 2025. It is a separate vendor from Candiru.

Aladdin is the name given to Intellexa's concept for delivering spyware through targeted advertising, documented by Amnesty International's Security Lab in 2025. It predates the public confirmation of AdFection and represents a similar convergence of ad-tech and surveillance by a different vendor.

Both AdFection (linked to Candiru) and Aladdin (linked to Intellexa) describe using targeted advertising to deliver spyware, but they are attributed to different vendors and documented by different research organizations. AdFection was documented by Citizen Lab in 2026; Aladdin was documented by Amnesty in 2025. They are parallel concepts, not the same campaign.

No. AdFection is attributed to Candiru and documented by Citizen Lab; Aladdin is attributed to Intellexa and documented by Amnesty International. They share the broad idea of advertising-based delivery but are distinct vendors, infrastructures, and investigations.

Primary sources include Citizen Lab (2021 Hooking Candiru and 2026 AdFection reports), Microsoft Threat Intelligence (2021 DevilsTongue/SOURGUM), Google Threat Analysis Group (2021), Avast/Gen Digital (2022), Recorded Future/Insikt Group (2025), Amnesty International Security Lab (2025), Confiant Threat Intelligence, the U.S. Department of Commerce, and the NIST National Vulnerability Database.

This site distinguishes confidence levels — CONFIRMED, HIGH CONFIDENCE, ASSESSED, REPORTED, and ALLEGED — and labels each claim accordingly. Assertions are backed by primary threat-intelligence sources with inline citations, and open questions are stated explicitly rather than papered over.

Defanging is the practice of altering an indicator (for example, writing example[.]com instead of example.com) so that it cannot be accidentally clicked or auto-resolved into a live connection. All IOCs on this site are displayed in defanged notation for defensive safety.

Defanged IOCs — domains, IPs, hashes, and certificates — are available in the searchable IOC database, with associated campaigns, components, confidence levels, and first/last-seen dates.

No. This site maintains a strict defensive posture. It never includes actionable offensive exploit code. It provides defensive guidance, indicators, and analysis for security professionals, journalists, and defenders.

This FAQ is reviewed and updated as new primary sources are published or as existing findings are revised. The last-updated date appears at the bottom of the page and in the article metadata.