Threat Intel
Zero-Click Candiru Spyware Reaches Al Jazeera via Targeted Online Ads
Researchers confirm that Candiru spyware infected at least 45 Al Jazeera devices through invisible ads, requiring no user interaction. The attack chain began with a Discover‑Tech ad server that identified targets and delivered malicious code to browsers or apps. Defenders should audit ad networks, block suspicious ad domains, and monitor for unexpected outbound connections to known spyware command‑and‑control hosts.
What Happened
Citizen Lab investigators discovered that Candiru, a government‑sold spyware suite, infected devices at Al Jazeera by exploiting ordinary online advertisements. The malicious payload was delivered when an ad loaded, even if the ad was invisible or ran in the background, and no click or user action was required.
Impact
At least 45 Al Jazeera endpoints were compromised in 2024 and 2025. Infected machines sent device identifiers to a Discover‑Tech server, which then routed Candiru code to the browser or app. The spyware was recovered from one device, confirming the chain of compromise.
Attack Flow
- Ad loads from Discover‑Tech network.
- Ad sends advertising ID and IP to Discover‑Tech server.
- Server checks target list; if matched, returns Candiru installation code.
- Code executes in browser/app, contacts Candiru C2 server.
- Spyware installs and begins data exfiltration.
Defender Actions
1. Audit and restrict third‑party ad networks; block traffic to known Discover‑Tech domains.
2. Monitor outbound connections for patterns matching the three‑step sequence (ad server → Candiru server → C2).
3. Deploy endpoint detection that flags zero‑click payloads and suspicious ad scripts.
4. Keep browsers, plugins, and operating systems fully patched to reduce exploitation surface.
5. Educate users that even invisible ads can be malicious, and encourage reporting of unexpected background activity.
Related articles
Pegasus Zero‑Click Spyware: Detection and Mitigation for iOS and Android
Pegasus has been infecting mobile devices via zero‑click exploits, silently collecting messages, calls, location and audio. The threat remains active on both iOS and Android. Defenders should verify device integrity, monitor for abnormal data exfiltration, and apply vendor‑specific hardening steps.
Read briefing
Corp MDM Android Spyware Targets Logistics Sector via Fake Google Play Pages
A targeted campaign is distributing Android spyware known as Corp MDM via fraudulent Google Play landing pages impersonating logistics brands. The malware, packaged as a system service, is designed to intercept inbound SMS traffic, manipulate call routing, and maintain persistent background execution using a hard-coded command-and-control infrastructure.
Read briefing
Project Zero details Pixel 9 0-click chain and Android audio attack surface
Project Zero published the third part of its Pixel 9 0-click exploit chain research, focusing on how audio processing in Google Messages and Pixel 9 TTS expands remote attack surface. The chain used CVE-2025-54957 in Dolby UDC and CVE-2025-36934 in the BigWave driver, both found quickly after targeted review. Defenders should prioritize patching, reduce unnecessary codec exposure, and audit AI/media features that process untrusted input before user interaction.
Read briefing
Operation Dream Job: From Job Offers to Zero‑Day Attacks on Defense Sectors
Check Point Research has traced a fresh wave of the Operation Dream Job campaign, a Lazarus‑linked effort that turns enticing job ads into a multi‑stage breach. The attackers now use a trojanized PDF viewer, the SecurityPDF app, to deliver a new kernel‑mode rootkit (FudModule) via the zero‑day CVE‑2026‑68820 in Microsoft’s AFD.sys driver. They also weaponize CVE‑2025‑49113 in Roundcube to plant RelayShell webshells, turning compromised servers into covert C2 relays. The campaign targets aerospace, aviation and defense firms worldwide, leveraging spear‑phishing, SEO‑boosted fake recruitment sit
Read briefing