Researchers at The Citizen Lab disclosed this week that devices belonging to journalists at Al Jazeera were infected with spyware built by Candiru — the Israeli mercenary surveillance vendor that Microsoft tracks as Sourgum and whose implant is known as DevilsTongue — through ordinary online advertisements. The delivery required zero interaction: no click, no hover, no download prompt. The malicious code executed the moment the ad rendered in the browser, and Citizen Lab noted that in some cases the ad loaded out of sight, in the background, meaning the victim never even saw the vehicle that compromised them.
This is a meaningful evolution in the commercial spyware delivery model. The industry has spent years hardening against zero-click iMessage and WhatsApp delivery chains; Candiru has demonstrated that the programmatic advertising ecosystem itself is now a viable zero-click delivery surface. Every organization with a browser estate is exposed to the ad ecosystem. Every high-risk user — journalists, executives, diplomats, attorneys, human rights workers — who loads a webpage is potentially rendering attacker-controlled content supplied through legitimate ad exchanges.
Defenders need to internalize two facts immediately. First, user-awareness training is irrelevant here: there is no user action to train against. Second, this attack succeeds or fails at the browser exploit and post-exploitation stages, which means detection engineering and exploit mitigation — not phishing controls — are where your defensive budget should go.
Technical Analysis
Threat actor and tooling
Candiru is an Israel-based spyware firm that sells exclusively to government customers. It has been sanctioned by the U.S. Department of Commerce (Entity List, 2021) and its tooling has been publicly documented by Microsoft (as DevilsTongue) and Citizen Lab in campaigns targeting politicians, journalists, activists, and dissidents across the Middle East, Europe, and Asia. The implant family is modular, Windows- and mobile-capable, and historically uses COM-hijack persistence and in-memory staging to minimize disk artifacts.
Attack chain (defender's view)
Based on the Citizen Lab reporting, the chain breaks down as follows:
- Delivery via programmatic advertising. The operators purchased or brokered ad placements through the legitimate ad-tech supply chain. Malicious creative was served to targeted victims — almost certainly using the ad industry's own targeting infrastructure (geography, device fingerprint, demographic signals) to ensure only intended victims received the weaponized creative. This is precision malvertising: the ad exchange is the targeting system.
- Render-time execution. The exploit fired when the ad was rendered — inside the browser's rendering pipeline — with no user gesture. Citizen Lab's note that ads sometimes loaded in the background (hidden iframes, background tabs, off-viewport placements) tells us the operators engineered the creative to trigger on layout/render, not on visibility or interaction events.
- Renderer-to-sandbox-escape. A zero-click render exploit only buys code execution inside the renderer sandbox. Full compromise requires a sandbox escape and privilege escalation, which is where browser child-process telemetry becomes your highest-fidelity detection surface: a successful escape almost always manifests as the browser process spawning something a browser never legitimately spawns.
- Implant staging and C2. Post-exploitation, DevilsTongue-class implants stage additional modules, establish persistence, and beacon to operator-controlled C2, typically over HTTPS to low-reputation or freshly registered infrastructure.
No CVE identifier has been published in association with this disclosure as of this writing, and Citizen Lab's public summary does not attribute the exploit to a specific patched vulnerability. Treat the underlying browser exploit as unpatched or recently patched and not yet publicly documented — which means assume exposure and lean on behavioral detection rather than patch-level verification alone.
Exploitation status
Confirmed active exploitation in the wild against a named target population (Al Jazeera journalists). This is not theoretical. Because the delivery surface is the global ad ecosystem, any organization whose users browse the open web should treat this TTP as available to well-resourced adversaries today. There is no CISA KEV entry at time of publication; monitor KEV and Citizen Lab's technical appendices for follow-on indicators.
Why this bypasses conventional controls
- Email and web gateway inspection sees a legitimate ad served over TLS from a legitimate ad exchange domain.
- User training has nothing to act on — there is no click.
- Reputation-based filtering fails because the creative transits high-reputation ad infrastructure, and the exploit may live in a late-stage redirect visible only to the targeted fingerprint.
The controls that do bite: browser exploit mitigations, renderer child-process monitoring, DNS-layer ad and tracker blocking, and egress anomaly detection.
Detection & Response
The single most reliable detection opportunity in a zero-click browser chain is the sandbox escape: the moment a browser renderer or browser process spawns a shell, script interpreter, or LOLBin, you are almost certainly looking at exploitation. That behavior has an extremely low legitimate base rate. The rules below are built around that principle, plus persistence establishment and staging artifacts.
Sigma Rules
---
title: Browser Process Spawning Shell or Script Interpreter - Possible Zero-Click Exploitation
id: 3f8a2c41-9b1d-4e7a-a6c2-5d8f0e1b2c3d
status: experimental
description: Detects a browser process spawning command shells, script interpreters, or LOLBins. A successful sandbox escape from a render-triggered exploit (e.g., Candiru/DevilsTongue delivered via malicious ad creative) typically manifests as the browser spawning cmd, PowerShell, mshta, rundll32, or similar. Near-zero legitimate base rate.
references:
- https://thehackernews.com/2026/10/citizen-lab-traces-zero-click-candiru.html
- https://attack.mitre.org/techniques/T1203/
- https://attack.mitre.org/techniques/T1189/
author: Security Arsenal
date: 2026/10/16
tags:
- attack.initial_access
- attack.execution
- attack.t1203
- attack.t1189
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\chrome.exe'
- '\msedge.exe'
- '\firefox.exe'
- '\brave.exe'
- '\opera.exe'
- '\iexplore.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\rundll32.exe'
- '\regsvr32.exe'
- '\wmic.exe'
- '\bitsadmin.exe'
- '\certutil.exe'
- '\schtasks.exe'
condition: selection_parent and selection_child
falsepositives:
- Rare enterprise browser extensions or legacy line-of-business integrations (IE-mode)
- Developer tooling launched from browser-based IDEs
level: high
---
title: Persistence Established by Browser-Spawned Process
id: 8c4d1e62-7a3b-4f5c-9d2e-1a6b8c0d3e5f
status: experimental
description: Detects registry Run key modification or scheduled task creation where the responsible process was spawned by a browser. DevilsTongue-class implants establish persistence immediately post-exploitation; a browser descendant writing autorun keys is a strong post-compromise signal.
references:
- https://thehackernews.com/2026/10/citizen-lab-traces-zero-click-candiru.html
- https://attack.mitre.org/techniques/T1060/
- https://attack.mitre.org/techniques/T1547/001/
- https://attack.mitre.org/techniques/T1053/005/
author: Security Arsenal
date: 2026/10/16
tags:
- attack.persistence
- attack.t1547.001
- attack.t1053.005
logsource:
category: process_creation
product: windows
detection:
selection_reg:
Image|endswith: '\reg.exe'
CommandLine|contains|all:
- ' add '
CommandLine|contains:
- '\CurrentVersion\Run'
- '\CurrentVersion\RunOnce'
selection_schtasks:
Image|endswith: '\schtasks.exe'
CommandLine|contains: '/create'
filter_parent_browser:
ParentImage|endswith:
- '\chrome.exe'
- '\msedge.exe'
- '\firefox.exe'
- '\brave.exe'
- '\opera.exe'
condition: (selection_reg or selection_schtasks) and filter_parent_browser
falsepositives:
- None identified; browser-initiated autorun persistence is not legitimate behavior in enterprise environments
level: critical
---
title: Browser Writing Executable to User-Writable Staging Directory
id: 2b7e9f04-4c6a-4d8b-b1f3-9e5a7c2d4f60
status: experimental
description: Detects browser processes writing PE executables or DLLs to user-writable staging locations outside standard download/update paths. Consistent with in-memory or staged implant deployment following a zero-click render exploit.
references:
- https://thehackernews.com/2026/10/citizen-lab-traces-zero-click-candiru.html
- https://attack.mitre.org/techniques/T1204/ - technique context; see T1059/T1105
- https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/10/16
tags:
- attack.execution
- attack.command_and_control
- attack.t1105
logsource:
category: file_event
product: windows
detection:
selection_image:
Image|endswith:
- '\chrome.exe'
- '\msedge.exe'
- '\firefox.exe'
- '\brave.exe'
selection_path:
TargetFilename|contains:
- '\AppData\Local\Temp\'
- '\AppData\Roaming\'
- '\ProgramData\'
- '\Users\Public\'
selection_ext:
TargetFilename|endswith:
- '.exe'
- '.dll'
- '.dat'
filter_updates:
TargetFilename|contains:
- '\AppData\Local\Google\Chrome\'
- '\AppData\Local\Microsoft\Edge\'
- '\AppData\Local\Mozilla\'
- '\Downloads\'
condition: selection_image and selection_path and selection_ext and not filter_updates
falsepositives:
- Browser component updates writing outside standard directories (rare)
- Web applications with local agent installers
level: high
KQL — Microsoft Sentinel / Defender
This first query is your primary hunt: browser-spawned shells and LOLBins over the past seven days, enriched with process lineage. In a clean environment this should return near-zero results; any hit warrants immediate triage.
let Browsers = dynamic(["chrome.exe","msedge.exe","firefox.exe","brave.exe","opera.exe","iexplore.exe"]);
let Shells = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","wmic.exe","bitsadmin.exe","certutil.exe","schtasks.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (Browsers)
| where FileName in~ (Shells)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, ProcessId, InitiatingProcessId
| order by TimeGenerated desc
The second query pivots from confirmed browser-spawned processes to their network activity — this is how you catch the implant's first C2 beacon even if the initial process execution alert was missed. It joins browser children against outbound connections to non-Microsoft, non-browser-vendor infrastructure.
let Browsers = dynamic(["chrome.exe","msedge.exe","firefox.exe","brave.exe","opera.exe"]);
let BrowserChildren =
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (Browsers)
| where FileName !in~ (Browsers)
| project ChildTime=TimeGenerated, DeviceId, ProcessId, FileName, ProcessCommandLine;
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| join kind=inner BrowserChildren on DeviceId, ProcessId
| where RemoteUrl !has_any ("microsoft.com","google.com","googleapis.com","mozilla.org","mozilla.net","windows.net","akamai")
| summarize Connections=count(), RemoteHosts=make_set(RemoteUrl, 20), RemoteIPs=make_set(RemoteIP, 20)
by DeviceName, FileName, ProcessCommandLine, bin(TimeGenerated, 1h)
| order by TimeGenerated desc
For environments ingesting proxy or firewall logs via CEF/Syslog, hunt for ad-tech redirect chains terminating at low-prevalence domains for specific users — a small population of targeted users receiving creatives from infrastructure nobody else in the org touches is the network-layer signature of precision malvertising:
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where RequestURL has_any ("doubleclick","googlesyndication","adservice","adnxs","taboola","outbrain")
or DeviceVendor has "proxy"
| summarize Hits=count(), Destinations=make_set(DestinationHostName, 50) by SourceUserName, SourceIP
| where Hits > 0
| join kind=inner (
CommonSecurityLog
| where TimeGenerated > ago(14d)
| summarize OrgWideHits=count() by DestinationHostName
| where OrgWideHits < 5
) on $left.SourceIP == $right.SourceIP
| project SourceUserName, SourceIP, Destinations, DestinationHostName, OrgWideHits
Tune the ad-domain list to what your proxy actually logs; the analytic logic — rare destinations observed for a tiny user population — is the durable part.
Velociraptor VQL
This artifact hunts live endpoints for browser processes with shell/script children, including full lineage and user context — useful both as a fleet-wide hunt and as a first-response triage step on a journalist's or executive's machine.
-- Hunt: browser processes with suspicious child processes (sandbox escape indicator)
LET browsers = SELECT Pid, Name AS BrowserName, CreateTime AS BrowserStart
FROM pslist()
WHERE Name =~ '(?i)(chrome|msedge|firefox|brave|opera|iexplore)\\.exe$'
SELECT Pid,
Ppid,
Name,
CommandLine,
Exe,
Username,
CreateTime,
BrowserName,
BrowserStart
FROM pslist()
WHERE Ppid in browsers.Pid
AND Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|wmic|bitsadmin|certutil|schtasks)\\.exe$'
For persistence triage on a suspect host, pair it with an autoruns sweep filtered to recently written entries:
-- Triage: recently created Run-key persistence entries (last 14 days)
SELECT Name,
Data,
FullPath,
Mtime
FROM glob(globs='HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*',
accessor='registry')
WHERE Mtime > (now() - 1209600)
ORDER BY Mtime DESC
Remediation and Hardening Script
There is no single patch to verify here — the defensive posture for zero-click render exploits is layered mitigation. This PowerShell script audits and enforces the highest-value Windows controls: Defender Network Protection, SmartScreen, PUA protection, exploit mitigations, and browser currency. Run it as a compliance check across the fleet via your RMM or Intune.
# Candiru zero-click malvertising hardening audit - run elevated
$report = @()
# 1. Microsoft Defender Network Protection - blocks outbound to low-reputation/C2 infrastructure
$np = Get-MpPreference | Select-Object -ExpandProperty EnableNetworkProtection
$report += [pscustomobject]@{Control='Defender Network Protection'; Status=if($np -eq 1){'Enabled'}else{'NOT ENABLED - remediating'}}
if ($np -ne 1) { Set-MpPreference -EnableNetworkProtection Enabled }
# 2. PUA protection - catches ad-fraud and spyware staging droppers
$pua = Get-MpPreference | Select-Object -ExpandProperty PUAProtection
$report += [pscustomobject]@{Control='PUA Protection'; Status=if($pua -eq 1){'Enabled'}else{'NOT ENABLED - remediating'}}
if ($pua -ne 1) { Set-MpPreference -PUAProtection Enabled }
# 3. Cloud-delivered protection + tamper protection
Set-MpPreference -MAPSReporting Advanced
Set-MpPreference -SubmitSamplesConsent SendAllSamples
$report += [pscustomobject]@{Control='Cloud protection (MAPS)'; Status='Set to Advanced'}
# 4. SmartScreen for Edge (blocks known-malicious and low-reputation web content)
$edgePath = 'HKLM:\SOFTWARE\Policies\Microsoft\Edge'
if (-not (Test-Path $edgePath)) { New-Item -Path $edgePath -Force | Out-Null }
Set-ItemProperty -Path $edgePath -Name 'SmartScreenEnabled' -Value 1 -Type DWord
Set-ItemProperty -Path $edgePath -Name 'SmartScreenPuaEnabled' -Value 1 -Type DWord
$report += [pscustomobject]@{Control='Edge SmartScreen + PUA'; Status='Enforced via policy'}
# 5. Chrome Safe Browsing Enhanced + policy hardening
$chromePath = 'HKLM:\SOFTWARE\Policies\Google\Chrome'
if (-not (Test-Path $chromePath)) { New-Item -Path $chromePath -Force | Out-Null }
Set-ItemProperty -Path $chromePath -Name 'SafeBrowsingProtectionLevel' -Value 2 -Type DWord
$report += [pscustomobject]@{Control='Chrome Enhanced Safe Browsing'; Status='Enforced via policy'}
# 6. ASR rule: block executable content from email client and webmail is less relevant here;
# the high-value one is 'Block execution of potentially obfuscated scripts' (scripted payload staging)
$asrRules = (Get-MpPreference).AttackSurfaceReductionRules_Ids
$asrActions = (Get-MpPreference).AttackSurfaceReductionRules_Actions
$obfuscated = '5BEB7EFE-FD9A-4556-801D-275E5FFC04CC' # Block execution of potentially obfuscated scripts
$idx = [array]::IndexOf($asrRules, $obfuscated)
if ($idx -lt 0 -or $asrActions[$idx] -ne 1) {
Add-MpPreference -AttackSurfaceReductionRules_Ids $obfuscated -AttackSurfaceReductionRules_Actions Enabled
$report += [pscustomobject]@{Control='ASR: obfuscated scripts'; Status='NOT ENABLED - remediating'}
} else {
$report += [pscustomobject]@{Control='ASR: obfuscated scripts'; Status='Enabled'}
}
# 7. Browser currency check - flag anything older than 30 days for forced update
$browsers = @{
'Chrome' = "$env:ProgramFiles\Google\Chrome\Application\chrome.exe"
'Edge' = "${env:ProgramFiles(x86)}\Microsoft\Edge\Application\msedge.exe"
}
foreach ($b in $browsers.GetEnumerator()) {
if (Test-Path $b.Value) {
$v = (Get-Item $b.Value).VersionInfo.ProductVersion
$age = (New-TimeSpan -Start (Get-Item $b.Value).LastWriteTime -End (Get-Date)).Days
$report += [pscustomobject]@{Control="$($b.Key) version"; Status="$v (binary age: ${age}d)" + $(if($age -gt 30){' - FORCE UPDATE'}else{''})}
}
}
$report | Format-Table -AutoSize
For macOS and iOS — which is where Al Jazeera's journalists have historically been hit hardest — enforce Lockdown Mode for all high-risk personnel. Lockdown Mode specifically disables just-in-time JavaScript compilation and blocks most web-font and complex media parsing, which removes exactly the attack surface render-triggered exploits need:
# Verify Lockdown Mode status on managed macOS/iOS devices via MDM
# Jamf Pro example: query the restriction across the fleet
sudo profiles show -type configuration | grep -i -A2 lockdown
# On macOS 13+, Lockdown Mode state is also visible locally:
defaults read /Library/Preferences/.GlobalPreferences LDMGlobalEnabled 2>/dev/null || echo "Lockdown Mode NOT enabled"
# Push via MDM payload (com.apple.applicationaccess):
# allowLockdownMode = true, then have the user enroll, or enforce for supervised devices.
Remediation
There is no vendor patch or CVE to track as of this writing — remediation here is architectural. Prioritize in this order:
1. Protect the high-risk population first. Journalists, executives, board members, legal counsel, and anyone whose threat model includes state actors should be on a hardened browsing profile today: Lockdown Mode on Apple devices, Chrome/Edge with Enhanced Safe Browsing and strict site isolation, and — critically — DNS-layer ad blocking. An enterprise DNS filter that resolves known ad-exchange and tracker domains to null (Pi-hole-style blocklists applied at the resolver, or a commercial protective DNS service) means the malicious creative is never fetched, which collapses this entire attack chain at step one. This is the single most effective countermeasure against ad-borne zero-click delivery and it is cheap to deploy.
2. Enforce browser currency aggressively. Zero-click render exploits live and die by patch gaps. Set a 7-day maximum browser age policy with forced restart-to-update. Inventory your fleet's browser versions this week and close any gap beyond 30 days immediately.
3. Deploy the detections above. The browser-spawns-shell analytic is the highest-fidelity signal available and costs almost nothing to run. Deploy the Sigma rule through your SIEM content pipeline, run the KQL hunt retroactively over 30 days, and schedule the Velociraptor artifact as a weekly fleet hunt. Any hit on a high-risk user is a P1 incident until proven otherwise.
4. Egress controls. DevilsTongue-class implants must call home. Enforce egress filtering that blocks direct-to-IP HTTPS and newly registered domains (NRD feeds are table stakes here), and alert on any browser-spawned process making outbound connections — browsers talk; their children should not.
5. Mobile device management for the targeted demographic. Deploy a mobile threat defense agent (or at minimum iOS Lockdown Mode plus rapid OS update enforcement) to the same high-risk population. Citizen Lab's body of work shows Candiru and its peers operate cross-platform; the ad that targets your Windows laptop today has an iOS sibling.
6. Monitor for follow-on intelligence. Citizen Lab typically publishes technical appendices with IOCs and C2 infrastructure after initial disclosure. Subscribe to their feed, Microsoft's threat intelligence blog (which tracks Candiru as Sourgum), and watch CISA KEV for any browser CVE that gets attributed to this campaign — when a CVE lands, patch within the KEV deadline and hunt retroactively against the published indicators.
7. Incident response posture. If you support journalists or other surveillance-target populations, pre-stage a DFIR playbook for suspected mercenary spyware: preserve the device (do not wipe), capture volatile memory, and engage specialist assistance — Amnesty International's Security Lab and Access Now's Digital Security Helpline both perform no-cost forensic analysis for civil-society targets, and commercial DFIR firms (including ours) maintain DevilsTongue-specific artifact checklists.
The strategic lesson is uncomfortable but clear: the ad-tech ecosystem is now demonstrated zero-click spyware delivery infrastructure. Defenders cannot fix the ad industry, but they can stop rendering its output for the people most likely to be targeted — and they can make the post-exploitation phase loud enough to catch.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.