AdFection
campaign · campaign:adfection-discover-tech-candiru-2026
Zero-click spyware delivery through targeted online ads placed by Discover-Tech, documented by Citizen Lab and Confiant on 2026-10-15; at least 45 Al Jazeera devices were targeted in 2024 and 2025.
Coverage
1
first 2026-10-16 → last 2026-10-16
Latest activity
2026-10-16
Citizen Lab: spyware delivery through targeted ads, with defence and government networks among the impressions
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector, defense, media
Sources cited
2
2 hosts
Defender insights
What each entry about AdFection tells a defender to do, newest first.
Story timeline
ATT&CK techniques (6 across 7 tactics)
6 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)
- ReconnaissanceGather Victim Host Information
- Resource DevelopmentAcquire Infrastructure: Malvertising
- Initial AccessDrive-by Compromise
- PersistenceEvent Triggered Execution: Component Object Model Hijacking
- Privilege EscalationEvent Triggered Execution: Component Object Model Hijacking
- StealthObfuscated Files or Information
- Command and ControlApplication Layer Protocol: Web Protocols
Reconnaissance TA0043
T1592Gather Victim Host Information×1
Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.).
Evidence: 2026-10-16/adfection-candiru-spyware-zero-click-ad-delivery · ATT&CK page ↗
Resource Development TA0042
T1583.008Acquire Infrastructure: Malvertising×1
Adversaries may purchase online advertisements that can be abused to distribute malware to victims. Ads can be purchased to plant as well as favorably position artifacts in specific locations online, such as prominently placed within search engine results. These ads may make it more difficult for users to distinguish between actual search results and advertisements. Purchased ads may also target specific audiences using the advertising network’s capabilities, potentially further taking advantage of the trust inherently given to search engines and popular websites.
Evidence: 2026-10-16/adfection-candiru-spyware-zero-click-ad-delivery · ATT&CK page ↗
Initial Access TA0001
T1189Drive-by Compromise×1
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including:
Evidence: 2026-10-16/adfection-candiru-spyware-zero-click-ad-delivery · ATT&CK page ↗
Persistence TA0003
T1546.015Event Triggered Execution: Component Object Model Hijacking×1
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system. References to various COM objects are stored in the Registry.
Evidence: 2026-10-16/adfection-candiru-spyware-zero-click-ad-delivery · ATT&CK page ↗
Privilege Escalation TA0004
T1546.015Event Triggered Execution: Component Object Model Hijacking×1
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system. References to various COM objects are stored in the Registry.
Evidence: 2026-10-16/adfection-candiru-spyware-zero-click-ad-delivery · ATT&CK page ↗
Stealth TA0005
T1027Obfuscated Files or Information×1
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Evidence: 2026-10-16/adfection-candiru-spyware-zero-click-ad-delivery · ATT&CK page ↗
Command and Control TA0011
T1071.001Application Layer Protocol: Web Protocols×1
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Evidence: 2026-10-16/adfection-candiru-spyware-zero-click-ad-delivery · ATT&CK page ↗
Entries about AdFection (1)
Co-occurring entities
Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.
Where this entity is cited
Source distribution
- blog.confiant.com1 (50%)
- citizenlab.ca1 (50%)