XERNOX SHIELD Detects Zero-Click Spyware Linked to Candiru Malware Campaign
XERNOX SHIELD identifies a Candiru-linked Windows spyware sample with a 100/100 malware detection score following the discovery of a sophisticated zero-click advertising attack.
MR. XERNOX
10/20/20262 min read
XERNOX SECURITY has successfully identified a malicious Windows sample associated with the sophisticated Candiru spyware campaign recently exposed by cybersecurity researchers.
During our October 18 investigation, XERNOX SHIELD classified the sample as malicious, assigned a detection score of 100/100, and reported a disarm action. The same sample was flagged as malicious by 55 out of 71 security vendors on VirusTotal, highlighting the severity of the threat.
This finding follows the discovery of a sophisticated spyware operation capable of targeting Windows systems through malicious online advertisements without requiring victims to click a link or download a suspicious attachment.
A Dangerous Zero-Click Malware Campaign
On October 15, 2026, researchers at the University of Toronto's Citizen Lab published an investigation exposing a spyware delivery technique known as AdFection. The investigation revealed how targeted online advertising infrastructure had been exploited to deliver Candiru spyware to selected victims.
Unlike conventional malware attacks, which often depend on tricking users into downloading malicious software, this campaign demonstrated how sophisticated attackers could exploit vulnerabilities through advertisements displayed in a web browser.
Researchers documented attacks involving devices associated with international news organization Al Jazeera. The findings highlight a serious cybersecurity concern: even users who practice safe browsing habits may face risks from advanced exploitation techniques.
XERNOX SHIELD Identifies the Malicious Sample
Following the publication of Citizen Lab's research, XERNOX SECURITY investigated a Windows malware sample associated with the disclosed campaign.
XERNOX SHIELD successfully classified the file as malicious and reported an action to disarm the threat.
Why Modern Spyware Is Difficult to Detect
Advanced spyware is designed to remain hidden while collecting sensitive information from compromised systems. According to Citizen Lab's research, the recovered Candiru malware component incorporated techniques including:
String obfuscation: Concealing internal functionality to complicate malware analysis.
COM hijacking: Abusing Windows component registration mechanisms to maintain persistence.
Stealth-focused execution: Using techniques intended to reduce visibility and complicate investigation.
These methods illustrate why modern endpoint security must go beyond simple filename checks and known malware signatures.
How XERNOX SHIELD Approaches Modern Malware
XERNOX SHIELD is developed around multiple security technologies intended to identify suspicious Windows activity, including:
Heuristic executable analysis.
Suspicious API and process behavior inspection.
Memory inspection for potentially malicious indicators.
Automated threat classification and response.
These capabilities are designed to help identify malicious software that may use obfuscation, unusual execution techniques, or suspicious system interactions. Our investigation produced a malicious-file detection for the sample associated with the Candiru campaign.
Malware Sample Identification
SHA-256: 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8
This fingerprint was published in connection with Citizen Lab's investigation and provides a reference for independent security research.
What Windows Users Should Know
Zero-click spyware represents an especially concerning category of cyber threats because successful exploitation may not require any obvious action from the victim. To reduce exposure, Windows users should keep their operating systems and browsers updated, install security patches promptly, and maintain active endpoint protection.
Advanced targeted spyware may require specialized forensic investigation, even when conventional security software is installed.
XERNOX SECURITY Continues Its Threat Research
At XERNOX SECURITY, our mission is to develop effective Windows security technology and continuously evaluate emerging cyber threats.
Our October 18 investigation demonstrates a successful malicious-file detection involving a sample associated with the recently disclosed Candiru spyware campaign.
We will continue researching new malware discoveries, evaluating XERNOX SHIELD's detection capabilities, and sharing technical findings with the cybersecurity community.
Research and References
Citizen Lab: How Discover-Tech Turned Targeted Ads Into a Pipeline for Spyware
VirusTotal: View the malware SHA-256 report
Contact
Secure your digital world with us.
© 2026. XERNOX SECURITY LLC, All rights reserved.