https://adfection-candiru.shop/news/ Technical threat intelligence on AdFection, Candiru spyware, DevilsTongue, Discover-Tech, Controlium and zero-click attacks delivered through targeted advertising. Updated as new research and findings are published. en © 2026 AdFection Research. All indicators published for defensive purposes only. editorial@adfection-candiru.shop (AdFection Research Editorial) webmaster@adfection-candiru.shop (AdFection Research) Security / Threat Intelligence 60 Sun, 18 Oct 2026 12:00:00 GMT https://adfection-candiru.shop/news/ adfection-research-2026-10-15-citizenlab-adfection Wed, 15 Oct 2026 00:00:00 GMT AdFection Citizen Lab First public technical confirmation of zero-click mercenary spyware delivered through targeted advertising, documenting attacks against Al Jazeera and linking Discover-Tech/Controlium to Candiru. https://adfection-candiru.shop/news/ adfection-research-2026-10-google-discovertech-removal Thu, 01 Oct 2026 00:00:00 GMT AdFection Citizen Lab / Confiant Following coordinated disclosure with Confiant, Google removes Discover-Tech from its ad platforms and certified vendor lists in early October 2026. https://adfection-candiru.shop/news/ adfection-research-2026-10-iab-europe-suspension Thu, 01 Oct 2026 00:00:00 GMT AdFection Citizen Lab IAB Europe suspends Discover-Tech following the AdFection disclosures. https://adfection-candiru.shop/news/ adfection-research-2026-10-adtech-enforcement Thu, 01 Oct 2026 00:00:00 GMT AdFection Citizen Lab / Confiant Beeswax terminates access; Vungle/Liftoff and Eskimi pause or block Discover-Tech accounts and domains in early October 2026. https://adfection-candiru.shop/news/ adfection-research-2026-10-15-candiru-dll Wed, 15 Oct 2026 00:00:00 GMT DevilsTongue Citizen Lab A Windows DLL recovered from a compromised Al Jazeera device is linked to Candiru through functional overlap with earlier DevilsTongue samples. https://adfection-candiru.shop/news/ adfection-research-2026-05-v1-fingerprint Fri, 01 May 2026 00:00:00 GMT Candiru Citizen Lab Citizen Lab notes the V1 fingerprinting behavior across 305 validator-associated domains begins disappearing during May–June 2026. https://adfection-candiru.shop/news/ adfection-research-2025-12-amnesty-aladdin Mon, 01 Dec 2025 00:00:00 GMT Intellexa Amnesty Amnesty International Security Lab publishes research on Intellexa's advertising-based delivery capability. https://adfection-candiru.shop/news/ adfection-research-2025-recordedfuture-integritylabs Wed, 01 Jan 2025 00:00:00 GMT Integrity Labs Recorded Future Recorded Future / Insikt Group identifies Integrity Labs Ltd while investigating Candiru-linked DevilsTongue infrastructure. https://adfection-candiru.shop/news/ adfection-research-2021-11-03-entity-list Wed, 03 Nov 2021 00:00:00 GMT Candiru U.S. Commerce The U.S. Department of Commerce adds Candiru (Saito Tech) to the Entity List. https://adfection-candiru.shop/blog/adfection-zero-click-spyware-delivery-pipeline/ adfection-research-blog-adfection-zero-click Sun, 18 Oct 2026 00:00:00 GMT AdFection AdFection Research Team Citizen Lab's October 2026 report confirms that targeted advertising infrastructure can deliver Candiru spyware without a single click. What AdFection is, how the attack chain works offensively, and why it changes the threat model for high-value targets. https://adfection-candiru.shop/blog/candiru-spyware-mercenary-operator-devilstongue/ adfection-research-blog-candiru-operator Sun, 18 Oct 2026 00:00:00 GMT Candiru AdFection Research Team Candiru is the Israeli mercenary spyware company behind DevilsTongue and the AdFection ad-based delivery method. History, offensive capabilities, infrastructure, and the 2025 rebranding as Integrity Labs. https://adfection-candiru.shop/blog/devilstongue-candiru-windows-surveillance-implant/ adfection-research-blog-devilstongue-analysis Sun, 18 Oct 2026 00:00:00 GMT DevilsTongue AdFection Research Team DevilsTongue is the Windows implant at the core of Candiru's offensive capability. Architecture, capabilities, persistence mechanisms, and the offensive design decisions that make it difficult to detect and analyze. https://adfection-candiru.shop/blog/discover-tech-adtech-spyware-targeting-infrastructure/ adfection-research-blog-discover-tech Sun, 18 Oct 2026 00:00:00 GMT Discover-Tech AdFection Research Team Discover-Tech is the Israeli adtech company at the center of the AdFection campaign. How its Controlium platform enabled targeted spyware delivery and the offensive capabilities of its URL delivery system. https://adfection-candiru.shop/blog/integrity-labs-candiru-rebrand-future-mercenary-spyware/ adfection-research-blog-integrity-labs Sun, 18 Oct 2026 00:00:00 GMT Integrity Labs AdFection Research Team Candiru has reportedly rebranded as Integrity Labs, with a 30 million dollar acquisition by Integrity Partners in 2025. Corporate rebranding, Entity List implications, and the future of mercenary spyware operations. https://adfection-candiru.shop/blog/adfection-weaponizes-programmatic-advertising-zero-click/ adfection-research-blog-adfection-rtb Sun, 18 Oct 2026 00:00:00 GMT AdFection AdFection Research Team The offensive mechanics behind AdFection: how real-time bidding, selective JavaScript delivery, and advertising-derived targeting combine to create a zero-click spyware delivery pipeline. https://adfection-candiru.shop/blog/candiru-attack-playbook-sherlock-to-adfection/ adfection-research-blog-candiru-playbook Sun, 18 Oct 2026 00:00:00 GMT Candiru AdFection Research Team Candiru has evolved its offensive delivery methods over years, from the Sherlock zero-click vector to the AdFection advertising-based pipeline. The evolution of attack techniques and what each innovation reveals. https://adfection-candiru.shop/blog/devilstongue-offensive-toolkit-com-hijacking-credential-theft/ adfection-research-blog-devilstongue-toolkit Sun, 18 Oct 2026 00:00:00 GMT DevilsTongue AdFection Research Team A deep dive into the offensive techniques DevilsTongue uses to maintain persistence, steal data, and communicate with operators. COM hijacking, session impersonation, credential access, and multi-layered C2 infrastructure. https://adfection-candiru.shop/blog/controlium-script-delivery-offensive-engine-adfection/ adfection-research-blog-controlium-script Sun, 18 Oct 2026 00:00:00 GMT Discover-Tech AdFection Research Team Controlium's URL delivery system, with its Script, De-anon, and Monitor types, is the offensive engine that makes AdFection's selective targeting possible. How each delivery type supports a stage of the attack chain. https://adfection-candiru.shop/blog/mercenary-spyware-supply-chain-integrity-labs-candiru-adtech/ adfection-research-blog-supply-chain Sun, 18 Oct 2026 00:00:00 GMT Integrity Labs AdFection Research Team The AdFection campaign reveals a supply chain where adtech companies, targeting platforms, exploit developers, and mercenary operators converge. Mapping the offensive ecosystem and what it means for the future of targeted surveillance.