Latest AdFection & Candiru Intelligence
A continuously updated newsroom tracking AdFection, Candiru, DevilsTongue, Integrity Labs, mercenary spyware, and AdTech security developments. Every item carries a publication date, event date, source, and confidence level.
- Published
- 2026-10-15
- Last reviewed
- 2026-10-18
- Last updated
- 2026-10-18
- Evidence
- CONFIRMED
Citizen Lab publishes AdFection report (Report 195)
First public technical confirmation of zero-click mercenary spyware delivered through targeted advertising, documenting attacks against Al Jazeera and linking Discover-Tech/Controlium to Candiru.
Google removes Discover-Tech from ad platforms and vendor lists
Following coordinated disclosure with Confiant, Google removes Discover-Tech from its ad platforms and certified vendor lists in early October 2026.
IAB Europe suspends Discover-Tech
IAB Europe suspends Discover-Tech following the AdFection disclosures.
Beeswax, Vungle/Liftoff, Eskimi cut off Discover-Tech
Beeswax terminates access; Vungle/Liftoff and Eskimi pause or block Discover-Tech accounts and domains in early October 2026.
Recovered Windows DLL attributed to Candiru
A Windows DLL recovered from a compromised Al Jazeera device is linked to Candiru through functional overlap with earlier DevilsTongue samples.
Candiru V1 validator fingerprint begins disappearing
Citizen Lab notes the V1 fingerprinting behavior across 305 validator-associated domains begins disappearing during May–June 2026.
Amnesty documents Intellexa 'Aladdin' ad-delivery concept
Amnesty International Security Lab publishes research on Intellexa's advertising-based delivery capability.
Recorded Future identifies Integrity Labs
Recorded Future / Insikt Group identifies Integrity Labs Ltd while investigating Candiru-linked DevilsTongue infrastructure.
Candiru added to U.S. Entity List
The U.S. Department of Commerce adds Candiru (Saito Tech) to the Entity List.
Last updated 2026-10-18 · This newsroom never publishes fabricated news.
