Candiru ZeroClick Spyware Delivered via Malicious Online Ads to Al Jazeera

In late 2026, Citizen Lab identified a zero‑click spyware campaign whereby the Israeli mercenary vendor Candiru delivered its surveillance implant through malicious online advertisements served by the ad‑tech intermediary Discover‑Tech via its ‘AdFection’ technique. The exploit leveraged a browser rendering vulnerability (likely a use‑after‑free in Skia) to achieve remote code execution on ad load, requiring no user interaction. Targets included journalists and staff at Al Jazeera, enabling exfiltration of SMS, call logs, microphone, camera, and location data via HTTPS C2 to cloud‑fronted domains. The incident demonstrates scalable, stealthy mercenary spyware distribution via legitimate ad ecosystems.

• Incident/Breach Overview
• Citizen Lab disclosed the zero‑click Candiru spyware campaign in late 2026.
• Targets included journalists and staff across multiple Al Jazeera bureaus and regional offices.
• Infections occurred via malicious online ads, affecting an estimated dozens to low‑hundreds of devices.

• No user interaction was required; exploitation happened on ad load, even off‑screen.

• Attack Vector/Campaign Mechanics

• Malicious ad creatives were supplied by Discover‑Tech through real‑time bidding (RTB) platforms.
• The “AdFection” technique used 1x1‑pixel or off‑screen iframes to hide the exploit.
• Exploit chain: use‑after‑free in Skia graphics library, heap spraying via malicious JS, ROP to bypass ASLR/DEP.
• Payload: Candiru modular backdoor capable of SMS, call logs, microphone, camera, and location exfiltration.

• C2 communication over HTTPS to domains hosted on CDNs (e.g., .cloudfront.net, .azureedge.net) with ad‑like User‑Agent strings.

• Threat Group Profile/Scale of Impact

• Candiru is an Israeli mercenary vendor that develops and sells surveillance tools to government clients.
• The campaign marks a shift from traditional exploit‑based infection to abuse of the legitimate ad ecosystem for scalable, stealthy surveillance.
• Geographic scope spanned Middle East, North Africa, Europe, and Asia, reflecting Discover‑Tech’s global ad network.

• Consequences included compromise of journalistic sources, potential exposure of whistleblowers, and heightened risks to press freedom.

• Indicators of Compromise (IoCs)/Defensive Actions

• File artifacts: /data/data/.so; persistence via cron‑like job or Android Accessibility Service abuse.
• Network IoCs: HTTPS POST/GET to cloud‑fronted domains; User‑Agent mimicking legitimate ad networks.
• Defensive measures: enable click‑to‑play for plugins, disable auto‑execution of scripts in ad iframes, enforce Site Isolation and hardened WebView.

• RTB platforms should vet ad creatives for obfuscated Base64 exploit code and monitor for 1x1 or off‑screen placements.

• Conclusion / Recommendations

• The incident underscores that zero‑click spyware can be delivered at scale via trusted advertising channels.
• Organizations must adopt browser‑level mitigations (e.g., Site Isolation, hardened WebView) and monitor ad‑related traffic for anomalies.
• Regular patching of browser components and timely threat‑intelligence feeds are essential.
• Collaboration between ad networks, security researchers, and victims is critical to detect and block such campaigns early.