DEV Community

Anoymask
Anoymask

Posted on

AdFection: Zero-Click Chain Delivering Candiru Spyware via Targeted Ads Without User Interaction

#security #threatintel

1. Basic Information

Because users can enter a zero-click spyware chain simply by displaying ads on normal websites or applications, user training alone is not enough to prevent it. Organizations must cross-reference advertising, browser, and endpoint telemetry to detect the targeted behavior of mercenary spyware.

2. Executive Summary

Discover-Tech's Controlium advertising infrastructure used real-time bidding (RTB) data to select specific individuals and redirected them to a validator and Candiru infrastructure simply by displaying ads. Citizen Lab confirmed a chain targeting at least 45 devices within Al Jazeera, along with Windows spyware samples.

3. Attack Flow

Path 1: Targeted Selection and Zero-Click Delivery via AdFection

  1. Controlium uses real-time bidding data to select targets based on ad placements, devices, and location data.
  2. When a target views a normal website or app, ad JavaScript runs and collects identification data.
  3. A validator re-confirms the target criteria and redirects only matching browsers to infrastructure managed by Candiru.
  4. Network records and recovered Windows samples support that target devices were compromised and connected to the Candiru spyware C2. Confiant stated that they did not recover the complete exploit chain. It has not been confirmed that infection can occur on all operating systems where ads were displayed.
  5. The spyware establishes persistence through COM hijacking, leading to monitoring and data collection by operators.

4. Attacker Position and Execution Location

  • Operators link the ad tech infrastructure with the commercial spyware infrastructure. Direct interaction with the victim is not required.

5. Visibility for Victims and Administrators

  • Victims and Users: Ads simply display on regular websites or apps, and there may be no clear warning screens or confirmation prompts.
  • Administrators: Appears as ad script or validator traffic from a small number of devices, browser anomalies, unknown binaries, and modified COM registrations.

6. Success and Failure Conditions

Success Conditions

  • The advertising ecosystem delivers Controlium ad creatives to the target device.
  • The validator determines the device is a target, and an unpatched exploit succeeds.

Failure Conditions and Countermeasures

  • Promptly update browsers and operating systems, and isolate ads and scripts on high-risk devices.
  • Block IOCs for advertising vendors, validators, and Candiru infrastructure at the DNS, proxy, and endpoint levels.

7. What Happens Upon Success

  • Leads to zero-click spyware infection, continuous monitoring, and theft of data and communication contents.
  • Real-time bidding data is abused for mass identification and precise targeting.

8. Observable Logs

These are investigation candidates for your organization. Availability depends on products, permissions, log settings, and retention periods, and a lack of records does not prove an absence of compromise.

  • Email: No email vectors specific to this case have been confirmed.
  • Proxy / SWG / DNS: Inference: Confirm chains from ad domains to validators, unknown redirects, and Candiru-related infrastructure.
  • Endpoint / EDR: Inference: Confirm browser child processes, crashes associated with exploits, unknown binaries, and COM registrations or hijacking.
  • Identity / IdP: Inference: Confirm email and cloud sessions and token usage after the spyware infection timestamp.
  • SaaS / Cloud: Inference: Confirm access to ad campaigns and vendors, browser syncing, and access to cloud data.
  • Network: Inference: Confirm validators and C2s connected by only a small number of devices, and redirect chains distinct from normal ad traffic.

9. Attack Success Assessment

Confirmed in Public Information

  • Subsequent Compromise Confirmed: Public Information: Citizen Lab confirmed infections based on Al Jazeera network records and Windows DLLs recovered from infected devices, where samples showed persistence via COM hijacking. At least 45 units refers to the number of targeted devices, not a confirmed count of all 45 units infected. Scope: 2024–2025 Al Jazeera cases and recovered Windows samples. Do not generalize to total ad impressions or all operating systems.

Separate contact, execution, persistence, data collection, and exfiltration, and do not infer unconfirmed success from a single alert.

10. Investigation Playbook

  • Investigation Starting Point: Start from related ad domains, validators, Candiru IOCs, browser anomalies, and COM modifications.
  • Initial Verification: Check high-risk users, viewed URLs, ad request chains, browser and OS versions, and endpoint alerts.
  • Device and Server Investigation: Preserve memory, browser artifacts, downloads, unknown binaries, COM registry entries, and network caches.
  • Authentication and Cloud Investigation: Check email, messaging, cloud, and SSO token usage from the infection timestamp onward.
  • Subsequent Actions: Track C2, access to documents and messages, camera and microphone use, and data exfiltration.
  • Containment: Isolate devices from the network, perform professional forensics, rotate credentials, and rebuild from trusted images.
  • Judgment Categories: Separate ad contact, validator selection, exploitation, spyware execution, persistence, and data access.

11. Defense and Detection Ideas

  • Single Event: Detect rare redirects from browsers to validator domains and modified COM registrations.
  • Time-Series Correlation: Correlate ad requests -> validator -> browser anomalies -> unknown binaries -> C2.
  • Threat Hunting: Search for related domains, sample hashes, COM hijacking, and rare communication destinations on high-risk user devices.
  • Log Limitations: Inference: Ad views alone cannot confirm individual targeting or infection. Cross-reference validators, C2s, and device evidence. Because targeted delivery has low reproducibility, preserve accessible URL, DNS, and browser records.
  • Priority Countermeasures: Prioritize rapid patching, browser isolation, ad script control, isolation of high-risk users, and network logging.

12. Facts / Inference / Hypothesis

Facts

  • Citizen Lab and Confiant analyzed Discover-Tech's Controlium as the AdFection chain directing targeted ads into zero-click spyware.
  • Citizen Lab analyzed approximately 4 billion bid records over four months, showing ad impressions across roughly 200,000 websites and apps and dozens of countries. This is not an infection count.
  • When ads render in a target browser, JavaScript collects identification data and guides the user through a validator to Candiru infrastructure.
  • At least 45 devices within Al Jazeera were targeted, and Citizen Lab confirmed infection chains and Windows spyware samples.
  • The SHA-256 hash of the Windows DLL recovered from an infected device is 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8, and persistence via COM hijacking was confirmed.
  • Citizen Lab assessed the partnership between Discover-Tech and Candiru with high confidence.
  • Following advance notice of the findings, Google and industry partners moved to block and restrict access to Discover-Tech. Removal by Google and IAB Europe occurred in early October 2026.
  • The Al Jazeera attacks are 2024–2025 cases. Infections are supported by network records and recovered samples, but Confiant noted they did not recover the complete exploit chain.

Inference

  • Because ad bidding data is used for target selection, ad tech vendor risks must be evaluated not only for privacy but also as an exploit delivery vector.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in "Unknowns and Additional Investigation."

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1189 Drive-by Compromise high Renders targeted ads to guide users into the exploit chain without user interaction. Source
T1546.015 Event Triggered Execution: Component Object Model Hijacking high Persistence via COM hijacking was confirmed in recovered Windows spyware. Source

14. Unknowns and Additional Investigation

  • The complete chain of browser and OS exploits used, total victim counts, all customers, Candiru operator command structures, and ongoing activity after removal from advertising networks remain unknown.

15. Impact on SOCs and Organizations

Because advertising infrastructure is used for both information gathering and exploit delivery, user training to avoid clicks cannot address this vector alone. Organizations protecting high-risk users should combine browser and OS updates, ad script controls, isolated environments, and log preservation while evaluating ad contact and infection as separate stages.

16. Summary by Role

  • SOC: Correlate ad scripts -> validator -> rare redirects or downloads, browser child processes, and COM hijacking.
  • Administrators: Modernize browsers and operating systems, and strengthen ad script controls, isolated environments, and external DNS and proxy log recording for high-risk devices.
  • Users: Because compromises can occur simply by viewing content, close and report abnormal browser behavior and do not delay updates.

Top comments (0)