Zero-Click Candiru Spyware Delivered via Malvertising: Detection and Hardening Guide for SOC Teams

Security researchers have documented a campaign in which devices at Al Jazeera Media Network were infected with Candiru spyware through a genuinely zero-click vector: targeted online advertisements. The victims did not click anything. The mere rendering of a malicious ad — served through legitimate programmatic advertising infrastructure — was sufficient to trigger exploitation and silently install commercial-grade surveillance malware.

This is a watershed data point for defenders. For years, security awareness programs have told users "don't click suspicious links." That guidance is now structurally obsolete against this class of threat. When the ad-tech ecosystem itself becomes the delivery mechanism, the attack surface is every device with a browser, every user browsing news sites, and every network that treats outbound web traffic as inherently benign.

Who is at risk: Journalists, dissidents, lawyers, activists, and executives are the documented targets of mercenary spyware vendors like Candiru — but the underlying technique (malvertising-driven zero-click exploitation) is platform-agnostic. Any organization whose users browse the open web is exposed to the delivery mechanism, even if the specific Candiru tooling is reserved for high-value targets.

Why act now: Candiru (tracked as Sourgum by Microsoft, tied to an Israel-based mercenary vendor) has been linked to attacks on over 100 victims across politics, human rights, academia, and media. The vendor's business model means its tooling is sold to multiple government customers simultaneously — your organization's threat profile doesn't need to match Al Jazeera's for you to inherit exposure from the same exploit chain or its derivatives.

Technical Analysis

Threat Actor and Tooling

Candiru is a private-sector offensive actor (PSOA) that develops and sells spyware — internally codenamed DevilsTongue per Microsoft's analysis — to government clients. Its implant capabilities typically include:

Message exfiltration from Signal, WhatsApp, Telegram, and other encrypted apps (defeating E2E encryption by reading at the endpoint)
Credential theft from browsers and password stores
File enumeration and exfiltration
Microphone and camera activation
Persistence designed to survive reboots while evading casual inspection
Anti-forensics: modular payloads, in-memory execution stages, and cleanup routines

The Attack Chain (Defender's View)

Based on the reported campaign mechanics, the kill chain looks like this:

Ad injection: The attacker purchases or compromises inventory in the targeted advertising ecosystem. Ads are fingerprinted/targeted so the malicious payload is only served to specific victim profiles (geography, organization, device type, behavioral markers). This is why broad honeypot scanning rarely catches these campaigns — the ad is benign for everyone except the intended target.
Zero-click trigger: The victim loads a page carrying the malicious ad. Rendering alone — the browser's ad iframe parsing, image/font decoding, or JavaScript execution within the ad slot — triggers the exploit. No user interaction occurs.
Renderer exploitation: A vulnerability in the browser's rendering engine (or an adjacent component like an image decoder) is exploited to gain code execution inside the sandboxed renderer process.
Sandbox escape / privilege escalation: A second-stage exploit breaks out of the renderer sandbox, yielding user- or system-level execution.
Implant staging: A lightweight downloader retrieves the DevilsTongue implant, typically staging components into user-writable locations (%APPDATA%, %TEMP%, or on mobile, app-adjacent directories) and establishing persistence.
C2 and exfiltration: The implant beacons to attacker infrastructure, often fronted by legitimate-looking domains or cloud services, and begins collection.

Affected Platforms

Candiru tooling has historically targeted Windows endpoints and Android/iOS mobile devices. The malvertising vector described in this campaign is primarily a browser-based delivery mechanism, meaning any platform whose browser rendered the ad was a candidate for exploitation. Media organizations, NGOs, and enterprises with users browsing ad-supported content should assume cross-platform exposure.

CVE and Exploitation Status

No CVE identifier is associated with this specific reporting, and we will not speculate on one. What defenders should internalize: zero-click browser exploit chains are actively traded commodities — Candiru and its peers maintain inventories of renderer and sandbox-escape bugs, rotating them as vendors patch. The correct defensive posture treats the browser as a contested, internet-facing attack surface equivalent to your perimeter VPN or email gateway. Confirmed exploitation is in-the-wild against named victims; this is not theoretical.

Detection & Response

Zero-click delivery means you will rarely catch the exploit itself. Your detection surface is the post-exploitation behavior: sandbox escapes producing anomalous child processes, browser-context processes writing persistence, and implants beaconing from unexpected process trees. The detections below target exactly that.

Sigma Rules

YAML

---
title: Browser Renderer Spawning LOLBin Child Process (Possible Zero-Click Exploit Chain)
id: 3f8c2a71-9b4e-4d61-a7c5-2e9f1b8d4a06
status: experimental
description: Detects browser processes spawning script interpreters or LOLBins, a strong indicator of post-exploitation activity following a browser-based zero-click compromise such as the Candiru malvertising campaign.
references:
  - https://www.bleepingcomputer.com/news/security/zero-click-attacks-used-targeted-ads-to-deliver-candiru-spyware/
  - https://attack.mitre.org/techniques/T1189/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.initial_access
  - attack.t1189
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\opera.exe'
      - '\iexplore.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\bitsadmin.exe'
      - '\certutil.exe'
      - '\schtasks.exe'
      - '\reg.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare browser-based enterprise tooling invoking download handlers
  - Legitimate browser extensions with native messaging hosts (verify binary path and signer)
level: high
---
title: Persistence Registry Run Key Written by Browser Process Context
id: 8b1d4e92-6c3a-4f57-b2d8-7a0e3c9f1d52
status: experimental
description: Detects a browser process (or its direct descendant) writing to Run/RunOnce registry keys, consistent with spyware implant persistence installation after a browser-delivered compromise.
references:
  - https://www.bleepingcomputer.com/news/security/zero-click-attacks-used-targeted-ads-to-deliver-candiru-spyware/
  - https://attack.mitre.org/techniques/T1060/
  - https://attack.mitre.org/techniques/T1547.001/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.persistence
  - attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\CurrentVersion\Run'
      - '\CurrentVersion\RunOnce'
  selection_image:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  filter_av_updaters:
    Details|contains:
      - 'GoogleUpdate'
      - 'MicrosoftEdgeUpdate'
      - 'MozillaMaintenance'
  condition: selection_key and selection_image and not filter_av_updaters
falsepositives:
  - Browser updater tasks (filtered above); legitimate software first-run registration
level: high

Analyst note on tuning: The first rule is intentionally scoped to browsers as the parent with LOLBins as the child — this is a genuinely rare process lineage in healthy environments. If you see volume, investigate your extension/native-messaging inventory before disabling the rule. The second rule's updater filter should be validated against your browser management tooling.

KQL — Microsoft Sentinel / Defender XDR

This hunt looks for the zero-click post-exploitation signature — browser-spawned LOLBins — and then pivots to the network behavior of those children, because a sandbox escape that never talks to the network is rarely the end state of a mercenary spyware chain.

KQL — Microsoft Sentinel / Defender

// Hunt: Browser processes spawning script interpreters / LOLBins,
// then pivot to outbound connections made by those child processes.
// Targets post-exploitation behavior of zero-click browser-delivered spyware (Candiru/DevilsTongue TTP).
let Browsers = dynamic(["chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe", "iexplore.exe"]);
let LOLBins = dynamic(["powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "bitsadmin.exe", "certutil.exe", "schtasks.exe", "reg.exe"]);
let BrowserSpawned =
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName in~ (Browsers)
    | where FileName in~ (LOLBins)
    | project SpawnTime=TimeGenerated, DeviceName, DeviceId,
              BrowserProc = InitiatingProcessFileName,
              ChildProc = FileName, ChildCmdLine = ProcessCommandLine,
              ChildProcessId = ProcessId, ChildCreationTime = TimeGenerated,
              AccountName, ReportId;
BrowserSpawned
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | project ConnTime=TimeGenerated, DeviceId, RemoteUrl, RemoteIP, RemotePort,
              InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCommandLine
) on $left.DeviceId == $right.DeviceId and $left.ChildProcessId == $right.InitiatingProcessId
| project SpawnTime, DeviceName, AccountName, BrowserProc, ChildProc, ChildCmdLine,
          ConnTime, RemoteUrl, RemoteIP, RemotePort
| order by SpawnTime desc

How to use it: Run over a 7-day window. A hit where ChildCmdLine contains encoded PowerShell (-enc, -e ), FromBase64String, DownloadString, or where the child process immediately establishes outbound connections to non-corporate infrastructure is a priority-one triage candidate. Cross-reference RemoteUrl/RemoteIP against your threat intel feeds and newly-registered-domain lists.

Velociraptor VQL

For live-response triage on a suspected victim endpoint — e.g., a journalist or executive reporting odd device behavior — this artifact enumerates browser-spawned child processes and their active network connections in a single collection:

VQL — Velociraptor

-- Artifact: Hunt browser-spawned LOLBin processes and their network connections
-- Use case: Post-exploitation triage for zero-click browser-delivered spyware (Candiru/DevilsTongue TTP)

SELECT Pid,
       Ppid,
       Name,
       Exe,
       CommandLine,
       Username,
       CreateTime
FROM pslist()
WHERE Name =~ '(?i)(powershell|pwsh|cmd|wscript|cscript|mshta|rundll32|regsvr32|wmic|bitsadmin|certutil|schtasks|reg)\.exe$'
  AND Ppid IN (
        SELECT Pid
        FROM pslist()
        WHERE Name =~ '(?i)(chrome|msedge|firefox|brave|opera|iexplore)\.exe$'
      )

Follow-up pivot — dump established connections from any non-browser process that is not your known system tooling, looking for the implant's C2:

VQL — Velociraptor

-- Artifact: Established outbound connections from suspicious non-standard processes
SELECT Pid,
       Name,
       Status,
       Family,
       Type,
       Laddr,
       Raddr
FROM netstat()
WHERE Status =~ 'ESTABLISHED'
  AND Raddr.IP !~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)'
  AND Name !~ '(?i)(chrome|msedge|firefox|teams|outlook|svchost|msmpeng|sense)\.exe$'
ORDER BY Name

Tune the exclusion list to your fleet's standard build. What you are hunting for is a small, quiet process holding a persistent outbound connection — the classic mercenary implant profile.

Remediation / Hardening Script

This PowerShell script performs rapid triage and hardening verification on a Windows endpoint: it audits for the persistence mechanisms and browser-spawned children described above, confirms browser patch posture, and flags unsigned binaries in user-writable staging directories favored by implant downloaders.

PowerShell

#Requires -RunAsAdministrator
# Security Arsenal - Zero-Click Browser Spyware Triage & Hardening Audit
# Use on suspected victim endpoints or as a fleet-wide compliance sweep.

Write-Host "=== [1] Browser Patch Posture ===" -ForegroundColor Cyan
$browserPaths = @(
    "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
    "$env:ProgramFiles (x86)\Google\Chrome\Application\chrome.exe",
    "$env:ProgramFiles (x86)\Microsoft\Edge\Application\msedge.exe",
    "$env:ProgramFiles\Mozilla Firefox\firefox.exe"
)
foreach ($p in $browserPaths) {
    if (Test-Path $p) {
        $v = (Get-Item $p).VersionInfo.ProductVersion
        Write-Host ("{0} : {1}" -f $p, $v)
    }
}
Write-Host "ACTION: Confirm versions match the latest stable channel. Zero-click chains die with patched renderers." -ForegroundColor Yellow

Write-Host "`n=== [2] Suspicious Run Key Persistence (non-standard entries) ===" -ForegroundColor Cyan
$runKeys = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce"
)
foreach ($k in $runKeys) {
    if (Test-Path $k) {
        $props = Get-ItemProperty $k
        $props.PSObject.Properties | Where-Object { $_.Name -notmatch '^PS' } | ForEach-Object {
            $val = $_.Value
            $exePath = ($val -split ' ')[0] -replace '"',''
            $signed = $null
            if (Test-Path $exePath -ErrorAction SilentlyContinue) {
                $signed = (Get-AuthenticodeSignature $exePath).Status
            }
            if ($signed -ne 'Valid') {
                Write-Host ("[SUSPICIOUS] {0} :: {1} = {2} (Signature: {3})" -f $k, $_.Name, $val, $signed) -ForegroundColor Red
            }
        }
    }
}

Write-Host "`n=== [3] Unsigned Executables in Implant Staging Directories (last 30 days) ===" -ForegroundColor Cyan
$stagingDirs = @("$env:APPDATA", "$env:LOCALAPPDATA\Temp", "$env:TEMP")
foreach ($d in $stagingDirs) {
    Get-ChildItem $d -Recurse -Include *.exe,*.dll -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
        ForEach-Object {
            $sig = Get-AuthenticodeSignature $_.FullName
            if ($sig.Status -ne 'Valid') {
                Write-Host ("[REVIEW] {0} | Written: {1} | Sig: {2}" -f $_.FullName, $_.LastWriteTime, $sig.Status) -ForegroundColor Red
            }
        }
}

Write-Host "`n=== [4] Recent Browser-Spawning-LOLBin Events (Sysmon / Security 4688) ===" -ForegroundColor Cyan
$events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue
if ($events) {
    $events | Where-Object { $_.Message -match '(?i)(chrome|msedge|firefox)\.exe' -and $_.Message -match '(?i)(powershell|cmd|wscript|mshta|rundll32|regsvr32)\.exe' } |
        Select-Object -First 20 | ForEach-Object {
            Write-Host ("[ALERT] {0}" -f $_.TimeCreated) -ForegroundColor Red
            Write-Host ($_.Message.Substring(0, [Math]::Min(400, $_.Message.Length)))
        }
} else {
    Write-Host "No 4688 process auditing events found. ENABLE process creation auditing with command-line logging." -ForegroundColor Yellow
}

Write-Host "`n=== Audit Complete. Escalate any [SUSPICIOUS]/[REVIEW]/[ALERT] findings to IR immediately. ===" -ForegroundColor Cyan

Remediation & Hardening

There is no single patch for "malvertising-delivered zero-click spyware" — remediation is a layered posture shift. Prioritize in this order:

1. Browser Currency Is Your First Control

Zero-click renderer exploits have short shelf lives precisely because vendors patch them aggressively. Enforce:

Rapid browser update rings — same-day or next-day for stable channel releases carrying security fixes. Treat browser CVEs with the same SLA as your perimeter appliances.
Kill stale installs: Block or quarantine endpoints running browsers more than one major version behind. A 60-day-old Chrome install is an open door to this exact threat class.

2. Disrupt the Delivery Vector: Ad Ecosystem Filtering

Since rendering the ad is the exploit trigger, not rendering untrusted ad content is a legitimate security control, not a convenience feature:

DNS-level ad/tracker blocking at the resolver (enterprise protective DNS, e.g., CISA's Protective DNS offering for eligible orgs, or commercial equivalents) strips a large fraction of programmatic ad inventory before it reaches the browser.
Managed browser policies deploying reputable content-blocking extensions for high-risk user populations (journalists, executives, legal, government affairs).
Proxy categorization: Block newly-registered domains and uncategorized ad-network endpoints at your secure web gateway. Candiru-style operators rotate infrastructure aggressively; NRD blocking catches much of it.

3. High-Risk User Programs

If your organization employs journalists, activists, executives, or anyone with a realistic mercenary-spyware threat model:

Enroll iOS users in Apple Lockdown Mode — it directly degrades zero-click exploit delivery, including web-based vectors.
Enroll at-risk users in Google Advanced Protection Program.
Provide dedicated, hardened devices for sensitive communications; separate browsing from credential-bearing sessions.

4. Endpoint Hardening

EDR in block mode, not audit. The post-exploitation behaviors above (browser→LOLBin chains, unsigned staging binaries) are high-confidence blockable.
Enable process creation auditing with command-line capture (Event ID 4688 with command line, or Sysmon) — you cannot hunt what you do not log. The triage script above will tell you if this is missing.
Attack Surface Reduction rules: While there is no browser-specific ASR rule, enable "Block execution of potentially obfuscated scripts" and "Block process creations originating from PSExec and WMI commands" to constrain post-exploit staging.

5. If You Suspect Compromise

Mercenary spyware demands full DFIR discipline, not AV remediation:

Isolate, don't wipe. DevilsTongue-class implants include anti-forensics; a reboot or AV scan may destroy volatile evidence. Capture memory first.
Image the device and preserve browser caches, ad-render artifacts, and network logs — the malicious ad itself is evidence and may identify the targeting parameters used against your user.
Engage specialist IR. Victims of mercenary spyware should also consider reporting to organizations like Citizen Lab, Access Now's Digital Security Helpline, or Amnesty International's Security Lab, which maintain detection tooling (e.g., MVT — Mobile Verification Toolkit) and can attribute tooling to specific vendors.
Assume credential compromise on the affected device — rotate credentials from a known-clean machine, not the victim endpoint.

6. Detection Engineering Follow-Through

Deploy the Sigma rules and KQL hunt above into your SIEM/EDR stack, baseline for 7–14 days, then promote browser→LOLBin detections to alerting. Mercenary spyware operators count on defenders treating the browser as trusted territory. Make it contested ground.

The Strategic Takeaway

The Al Jazeera/Candiru campaign demonstrates that the advertising supply chain is now an exploitation vector of choice for state-grade actors. You cannot train users out of rendering a webpage. You can strip untrusted ad content at the network layer, keep renderers patched inside a 48-hour window, and detect the post-exploitation behavior that every zero-click chain must eventually exhibit. Defense-in-depth is not a cliché here — it is the only model that survives a threat with no click, no phish, and no user error.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub