Candiru spyware delivered via zero-click targeted ad attacks

Sat, 17 Oct 2026 14:12:31 +0000

Engineer — Learn: Zero-click ad rendering as a spyware delivery vector suggests browser isolation and strict CSP controls are worth re-evaluating, but no specific CVE, patch, or affected software is identified in the available summary.
SOC/IR — Learn: The ad-network-as-delivery-mechanism technique is worth understanding for campaign awareness, but no IOCs or ATT&CK-mappable TTPs are provided to enable a hunt or detection rule at this time.
Leader — Learn: Candiru commercial spyware targeting a major media organization via zero-click ads signals ongoing risk to high-profile or politically sensitive organizations; relevant context for briefings if your sector is a plausible target.

Candiru on CuraSec