Citizen Lab: Candiru Spyware Infected Al Jazeera PCs via Banner Ads, No Click Needed
Citizen Lab detailed AdFection, a scheme in which Tel Aviv-based Discover-Tech delivered Candiru spyware through ad exchanges including Google, Beeswax and Yandex. At least 45 Windows devices at Al Jazeera were infected in 2024–2025 with no click or download required.
- At least 45 Al Jazeera Windows devices infected in 2024–2025
- AdFection ran through Google, Beeswax and Yandex ad exchanges
- NOAS server delivered payloads only to confirmed targets
- Recovered DLL used same XOR key as Candiru's DevilsTongue
Read next
Security