Candiru
Israel · psoa
Tracked by CyberSIXT since 15 Oct
- Articlesall time
- 5
- Articleslast 30 days
- 5
- CVEs exploitedattributed · all time
- 0
- Research reportsall time
- 0
5 articles from 5 outlets since 15 Oct; 1 in the last 7 days.
- Article
- First report
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 20 Oct · 08:19 UTC | SecurityOnline | Spyware Used Targeted Ads to Infect Al Jazeera Devices Without Clicks |
| Mon 19 Oct · 20:30 UTC | Dark Reading | Spyware Firm Used Online Ads to Launch Zero Click Infections |
| Sat 17 Oct · 11:30 UTC | SecurityWeek | Spyware Campaign Used Targeted Ads to Deliver Zero Click Hacks |
| Thu 15 Oct · 16:27 UTC | The Hacker News | Candiru spyware reached real devices through targeted online ads, Citizen Lab finds |
| Thu 15 Oct · 14:36 UTC | Security Affairs | Spyware Firm Used Adverts to Target Users With Zero Clicks |
Profile
Written by CyberSIXT from the sources listed below. Updated 26 Oct.
Microsoft tracks Candiru as Caramel Tsunami and DEV-0236 and attributes its origin to Israel2,3. Microsoft classifies Candiru as a private-sector offensive actor, while Malpedia lists SOURGUM as an alias and associates it with DevilsTongue1,4,5.
Citizen Lab linked an advertising-delivered spyware operation targeting Al Jazeera to Candiru with high confidence, as reported by The Hacker News6. Researchers recovered a spyware sample from one device and found that compromise began when an advertisement loaded, without user interaction, although the exact exploitation flow was not captured in code6. Security Affairs reported that Citizen Lab emphasised that advertisement exposure did not automatically mean infection7.
Sources
- Candiru: category · Microsoft
- Candiru: alias · Microsoft
- Candiru: origin · Microsoft
- Candiru: alias · Malpedia
- Candiru: software · Malpedia
- Candiru spyware reached real devices through targeted online ads, Citizen Lab finds · The Hacker News · 2026-10-15
- Spyware Firm Used Adverts to Target Users With Zero Clicks · Security Affairs · 2026-10-15
Diamond Model
What the record links to CandiruRecorded associations sorted by Diamond Model vertex. They do not reconstruct an intrusion or establish a campaign. Model: Caltagirone, Pendergast and Betz (2013).
Names and sources
- Caramel Tsunami
- CyberSIXT coverage, Malpedia, Microsoft, MISP Galaxy
- Candiru
- Malpedia, MISP Galaxy
- SOURGUM
- Malpedia, MISP Galaxy
- DEV-0236
- Microsoft
Attributed facts
- Origin
Israel Microsoft · Caramel Tsunami
- Category
Psoa Microsoft · Caramel Tsunami
- Motivation
Psoa Microsoft · Caramel Tsunami
Malware and tools
Malpedia · caramel_tsunami 1
MITRE ATT&CK® techniques
No MITRE ATT&CK® techniques are recorded for Candiru.
- Spyware Used Targeted Ads to Infect Al Jazeera Devices Without ClicksSecurityOnline
- Spyware Firm Used Online Ads to Launch Zero Click InfectionsDark Reading
- Spyware Campaign Used Targeted Ads to Deliver Zero Click HacksSecurityWeek
- Candiru spyware reached real devices through targeted online ads, Citizen Lab findsThe Hacker News
- Spyware Firm Used Adverts to Target Users With Zero ClicksSecurity Affairs · first in our coverage