Cutsign — Citizen Lab: Discover-Tech targeted ads delivered Candiru spyware zero-click to Al Jazeera devices

AI-generated verdict card, published automatically by the pipeline on day one because the brief rated the story P1. Version 1, as of 2026-10-31; hype score 6 (below the usual publish bar: early read from few sources, revised as the story develops). Written by a model from the stored public sources and not reviewed by a person; re-issued in place when the evidence changes (the URL stays). The detection-coverage table below is checked automatically from public sources and re-checked daily. All cards

Citizen Lab: Discover-Tech targeted ads delivered Candiru spyware zero-click to Al Jazeera devices

Hunt + hardenP1confidence: highP1 +2deep read +13 publishers +1primary source +1actor named +1P1: card on day one (score below the publish bar; revised as the story develops)

Citizen Lab reports that an Israeli ad firm's targeted ad placements delivered Candiru (DevilsTongue) spyware with no click to at least 45 Al Jazeera devices in 2024-2025. Today, pull Citizen Lab's indicators, hunt proxy and DNS logs from high-risk staff devices for the ad-to-validation-to-C2 sequence, and consider ad-blocking for those users.

Triage: Delivery is confirmed by primary research, and it is zero-click through a channel any browsing device can receive [S1][S3]. Exposure for a financial enterprise depends on whether it has high-risk staff who could be selected as targets.

The core claim comes from Citizen Lab's primary research [S3] and is corroborated by two secondary outlets [S1][S2]. The provided text has no domains, hashes or exploit details, so hunts stay behavioural until the report's indicators are pulled.

What happened

Discover-Tech bought targeted ad placements. When rendered, an ad connects back to Discover-Tech and submits advertising identifiers for the user [S1].
A NOAS/getAd server returns JavaScript only to selected targets, delivering Candiru spyware without a click [S1][S3].
At least 45 Al Jazeera devices were hit in 2024-2025 [S1][S2].
Network logs showed a sequence from Discover-Tech infrastructure to Candiru validation servers, then to spyware command-and-control servers [S2].
Citizen Lab recovered a DLL from a compromised Windows system and attributed it to Candiru with high confidence [S2].

Timeline

2024-2025	At least 45 Al Jazeera devices compromised via targeted-ad delivery [S1]
2026-10-19	Citizen Lab research and press coverage published [S3]

Detect

Ad-rendered requests to NOAS/getAd endpoints · Web proxy / secure web gateway

index=* (url="*getAd*" OR url="*noas*") | stats count min(_time) as first max(_time) as last values(url) as urls by src, user, dest | sort - count

FROM logs-* | WHERE url.original LIKE "*getAd*" OR url.original LIKE "*noas*" | STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp), urls = VALUES(url.original) BY source.ip, user.name, destination.ip | SORT count DESC

A hit means: A device rendered an ad that called a getAd/NOAS-style endpoint. This is a lead, not proof: the exact URL pattern and domains are not in the provided text, so match dest against Citizen Lab's published Discover-Tech indicators before escalating [S1][S3].

Unsigned DLL loaded into browser process · EDR / Sysmon image-load events (Windows)

index=* EventCode=7 Signed=false (Image="*\\chrome.exe" OR Image="*\\msedge.exe" OR Image="*\\firefox.exe") | stats count values(ImageLoaded) as dlls by host, Image, Hashes | sort count

FROM logs-* | WHERE event.code == "7" AND dll.code_signature.signed == false AND (process.executable LIKE "*\\chrome.exe" OR process.executable LIKE "*\\msedge.exe" OR process.executable LIKE "*\\firefox.exe") | STATS count = COUNT(*), dlls = VALUES(dll.path) BY host.name, process.executable, dll.hash.sha256 | SORT count ASC

A hit means: An unsigned module loaded into a browser on Windows. This is low fidelity. Candiru dropped a DLL on a Windows host [S2], but the provided text does not say which process loaded it or where it was written. Compare hashes against Citizen Lab's published hashes, if any.

Verify

A true positive shows the full chain from one device in order: a Discover-Tech/NOAS request, then Candiru validation servers, then C2 [S2][S3].
Match destinations and hashes against the indicators in the Citizen Lab report [S3]. The press summaries do not print them.
Benign look-alikes: ordinary ad-tech traffic with getAd-style paths is common. Unsigned DLLs in browsers often come from extensions, accessibility tools or DLP agents.

Scope

Affected

Devices that render ads placed by Discover-Tech [S1]
Windows hosts (Candiru DLL recovered from one) [S2]
At least 45 Al Jazeera devices in 2024-2025 [S1][S2]

Only if

The device's advertising identifiers mark it as a selected target; the getAd server returns JavaScript only to eligible targets [S1][S3]

Not affected if

None stated by the sources.

Enumerate

High-risk staff: executives, deal teams, staff in contact with journalists or with regulators in exposed jurisdictions
Their devices and browsers, including mobile and personal devices used for work
Proxy and DNS history for those devices back to 2024
Advertising-ID and ad-blocking posture on those devices

Contain

Isolate a device with a matching chain from the network. Do not power it off.
Capture memory and disk images before any cleanup. Reimaging destroys evidence and cannot be undone.
Block Discover-Tech, Candiru validation and C2 indicators at DNS and proxy once they are taken from [S3].
Rotate credentials and sessions used on the affected device from a clean device.
Option for high-risk staff: enforce ad-blocking and reset advertising IDs. This is a hardening choice, not a source-stated fix.

Eradicate

Remove the Candiru DLL and any associated persistence. The provided text does not describe the persistence mechanism [S2].
The exploit used after the JavaScript was delivered is not described in the provided text. Treat the browser and OS as untrusted until that is known.

Recover

Rebuild from known-good media rather than cleaning in place.
Before returning the device, validate the browser and OS are fully patched.
Afterwards, monitor proxy and DNS from the user's new devices for Discover-Tech/NOAS and Candiru destinations [S3].

Re-enter the loop when

Citizen Lab or others publish domains, hashes or exploit CVEs for this chain.
A browser or OS vendor issues an advisory tied to the delivered JavaScript.
Reporting shows Discover-Tech ads reaching sectors beyond media, or mobile platforms.
Any hunt hit completes the ad-to-validation-to-C2 sequence.

Debrief

Record which high-risk users were checked, the log retention reached, and any hits with their verification outcome.
Gap: the provided sources do not print domains, hashes, exploit details or the persistence mechanism.
Gap: it is unclear whether the ad networks that carried the placements have removed them.

Detection coverage — checked automatically

Category	Source	Status
Vendor	Impacted vendor / CERT advisory	published — primary source among the thread's sources: https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/
Government	CISA KEV	not checkable — no CVE: the catalog is keyed by CVE
EDR / endpoint VM	CrowdStrike blog	nothing found — no post names it among the feed's 10 newest items
EDR / endpoint VM	Microsoft Security blog	nothing found — no post names it among the feed's 10 newest items
EDR / endpoint VM	SentinelOne blog	nothing found — no post names it among the feed's 10 newest items
EDR / endpoint VM	SentinelOne Labs	nothing found — no post names it among the feed's 10 newest items
WAF / edge	Akamai blog	nothing found — no post names it among the feed's 1183 newest items
WAF / edge	Cloudflare WAF managed-ruleset changelog	nothing found — no post names it among the feed's 139 newest items
Cloud / container	Wiz blog	nothing found — no post names it among the feed's 717 newest items
IDS / research	Cisco Talos blog	nothing found — no post names it among the feed's 15 newest items
Detection content	Elastic detection rules	nothing found — no rule file names DevilsTongue / AdFection / Candiru
Detection content	Elastic Security Labs	nothing found — no post names it among the feed's 102 newest items
Detection content	SigmaHQ rules	published — 4 files name DevilsTongue / Candiru: rules-emerging-threats/2021/TA/SOURGUM/proc_creation_win_apt_sourgrum.yml, rules-emerging-threats/2021/Exploits/CVE-2021-33771/registry_set_cve_2021_31979_cve_2021_33771_exploits.yml, rules-emerging-threats/2021/Exploits/CVE-2021-33771/file_event_win_cve_2021_31979_cve_2021_33771_exploits.yml, deprecated/windows/driver_load_win_vuln_hw_driver.yml
Detection content	Splunk ESCU	nothing found — no rule file names DevilsTongue / AdFection / Candiru
MSSP / IR firms	Arctic Wolf blog	nothing found — no post names it among the feed's 10 newest items
MSSP / IR firms	Huntress blog	nothing found — no post names it among the feed's 754 newest items
MSSP / IR firms	Rapid7 blog	nothing found — no post names it among the feed's 20 newest items
MSSP / IR firms	Sophos threat research	nothing found — no post names it among the feed's 15 newest items
Research	Unit 42	nothing found — no post names it among the feed's 15 newest items

Checked automatically 2026-11-10 05:36Z from public sources: 2 published, 16 nothing found, 1 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

What a person would still look up (4)

Secure web gateway / DNS security	Whether Discover-Tech and Candiru infrastructure from the Citizen Lab report is categorised or blockable, and whether ad-script requests are logged with full URL.
EDR	Whether image-load and signature telemetry for browser processes is collected, and whether published Candiru DLL hashes can be swept retrospectively.
Mobile threat defence	Whether high-risk staff mobile devices are enrolled and send network telemetry. The sources do not state mobile targeting.
Browser management	Whether ad-blocking and advertising-ID controls can be enforced for a high-risk user group.

Exposure queries — generated automatically

No CVE in this campaign: nothing an internet scanner keys on. Scope by product in your own tool.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-10 05:36Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

What are the exact NOAS/getAd URL patterns and domains? The hunt patterns are guesses until checked against [S3].
Which browser or OS vulnerabilities did the delivered JavaScript exploit, and are they patched?
Were targets outside Al Jazeera, including financial-sector staff, identified?
Through which ad exchanges were Discover-Tech placements bought?

Sources

[S1] https://www.bleepingcomputer.com/news/security/zero-click-attacks-used-targeted-ads-to-deliver-candiru-spyware/ · BleepingComputer
[S2] https://www.securityweek.com/israeli-ad-firm-doubled-as-candirus-zero-click-spyware-delivery-channel/ · SecurityWeek
[S3] https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/ · The Citizen Lab

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically; a dismissed draft unpublishes it.