Search — “Candiru”

Citizen Lab reported that Candiru spyware infected at least 45 Al Jazeera devices in 2024 and 2025 via ads placed by Discover-Tech, with no user interaction required and some ads loading invisibly in the background. Each ad carried a beacon that sent the device's advertising ID and IP address to a Discover-Tech server, which returned attack code only for targeted devices. Hunters should look for devices contacting a Discover-Tech ad server followed by a Candiru screening server and then a command-and-control server, and check for the published domain mtrtb[.]com and the recovered sample hash.

Citizen Lab found Israeli ad firm Discover-Tech buying targeted ad placements whose scripts call a NOAS/getAd server that returns JavaScript only to selected targets, delivering Candiru (DevilsTongue) spyware with no click. At least 45 Al Jazeera devices were hit in 2024-2025; network logs showed a sequence from Discover-Tech infrastructure to Candiru validation servers to spyware C2, and a Candiru DLL was recovered from a Windows host. Hunters should look for ad-rendered script requests to Discover-Tech/NOAS and Candiru domains from high-risk staff devices; the sources shown do not print specific domains or hashes.