Citizen Lab Links Candiru Spyware Infections at Al Jazeera to Zero-Click Ads
Summary
Citizen Lab says targeted ads delivered zero-click Candiru spyware to at least 45 Al Jazeera devices in 2024 and 2025. Google and ad platforms removed or restricted Discover-Tech after the findings.
Key points
- The ads reportedly sent device advertising IDs and internet addresses to a Discover-Tech server, which selected targets and then delivered browser or app attack code.
- Citizen Lab said at least 45 Al Jazeera devices were targeted in 2024 and 2025 and linked the operation to Candiru with high confidence; it did not identify the government behind it.
- Researchers recovered spyware from one device but not the initial browser or app exploit. Traffic logs and similarities to a previously analyzed Candiru tool supported the attribution.
- Google and IAB Europe removed Discover-Tech from their vendor lists, while several ad platforms cut off or paused its access after the findings.
- Citizen Lab said Discover-Tech's ads appeared across many apps and websites and on networks of major institutions, but an ad appearing on a network does not establish that a device there was infected.
- The researchers and Confiant published indicators defenders can use to search for the reported sequence of connections: a Discover-Tech ad server, a Candiru screening server, then a command-and-control server.
Article Details
- Attack Vectors
- Targeted online ads delivered hidden code when loaded, including in some cases when an ad appeared out of sight in the background; no user click or other action was required.
- The ad code sent the device's advertising ID and internet address to a Discover-Tech server, which selected target devices and returned browser or app attack code for them.
- Researchers described the initial browser or app compromise based on the attack setup; they did not recover the exploit code.
- On infected devices, traffic logs showed connections first to a Discover-Tech ad server, then a Candiru screening server, and finally a command-and-control server.
- Defensive Notes
- Search traffic logs for the reported connection sequence: Discover-Tech ad server, Candiru screening server, then command-and-control server.
- The article says the researchers published web addresses and files associated with the operation for defenders to block and search for; it does not include those indicators in the supplied content.
- An ad appearing on an organization's network is not evidence that a device was infected.