Candiru Spyware Scanner in 2025: Practical Detection

Quick Answer: Zero Breach functions as a local Candiru spyware scanner, auditing host artifacts like browser records, DNS caches, and user-level COM registrations without admin rights. It evaluates local evidence against published AdFection indicators entirely off-network. This gives security teams a zero-risk mechanism to check high-risk endpoints for silent ad-delivered spyware persistence.

Real-time ad bidding networks have transformed online advertising into a stealth exploitation vector. In October 2026, Citizen Lab documented how ad-tech vendor Discover-Tech used its Controlium platform to fingerprint devices and deliver zero-click spyware to targets, including at least 45 devices at Al Jazeera. Using a dedicated Candiru spyware scanner like Zero Breach allows defenders to examine endpoint traces for known indicators without altering system state or triggering network alerts.

Understanding the AdFection Campaign and Candiru Spyware

The AdFection attack vector bypasses traditional perimeter defenses by exploiting real-time bidding (RTB) auctions. When a targeted user visits a mainstream news site or platform serving programmatic ads, the malicious ad script executes instantly during page rendering. No user interaction, click, or prompt is needed. The ad payload fingerprints the client, verifies the target, and delivers Candiru's DevilsTongue surveillance malware directly through browser process memory.

According to intelligence published by Recorded Future's Insikt Group in report CTA-2025-0805, Candiru operators rely heavily on ephemeral staging domains and legitimate signed drivers to maintain access. The attack infrastructure rotates domains frequently to evade static IP blocks. However, the client-side infection leaves persistent artifacts behind across local configuration stores and browser caches.

[RTB Ad Auction] -> [Ad Engine Fingerprints Host] -> [Zero-Click Payload] -> [DevilsTongue Persistence]

Unlike traditional malware that leaves obvious binaries in system directories, AdFection ad-delivered spyware hides within user-writable configuration spaces. It frequently abuses per-user COM registrations and vulnerable signed drivers like HW.sys to achieve persistence and privilege escalation. Spotting these subtle traces requires auditing specific user context pathways that typical enterprise antivirus scans gloss over.

Here's where most threat hunting guides fail: they assume the presence of a file on disk guarantees an active infection. In practice, ad-delivered spyware often reuses legitimate components. That said, there's a real catch when relying on file checks alone.

How Zero Breach Operates as a Read-Only Scanner

Zero Breach was developed as a local read-only zero-click malware forensic audit tool designed for immediate triage. It requires no administrator privileges, installs no third-party dependencies by default, and makes zero outbound network requests during execution. This zero-network guarantee is essential: querying external threat databases directly from a compromised host alerts the threat actor that detection is underway.

To run standard scans, the tool uses standard Python library modules across Windows, macOS, and Linux. When evaluating pattern rules, it integrates an optional hash-pinned YARA-X engine to inspect local files smaller than 1 megabyte. The primary scan scope focuses on locations writable by standard user accounts, where modern browser payloads land.

# Standard unprivileged execution flow
python -X utf8 zero-breach.py

DFIR analysts frequently hit a technical roadblock during triage: database locks. Because browsers lock their internal SQLite databases (such as History, Web Data, and Cookies) during active sessions, Zero Breach must read around these locks or process temporary file snapshots. Running a scan while Chrome, Edge, Brave, or Firefox is active can cause skipped files or incomplete reads. Always close browser processes before executing a scan to ensure raw database files can be parsed cleanly.

This next part matters more than it looks: how the tool categorizes what it finds.

Key Forensic Artifacts and Evidence Hierarchy

Not all forensic matches hold equal weight. Zero Breach applies an evidence-grading model to distinguish actionable infection leads from passive web references. A cached news article discussing Candiru infrastructure contains the same domain string as an actual command-and-control server contact, but their security context is completely different.

To resolve this, the scanner separates host artifacts into distinct categories:

• Connection Evidence: Stored HSTS headers, HTTP caches, cookie metadata hostnames, and Service Worker registration records showing actual host communication.
• Passive References: Strings found inside saved HTML pages, favicons, or LocalStorage keys that mirror public IOC lists without showing active protocol traffic.
• Host Persistence: User-level COM object overrides in the Windows Registry (HKCU\Software\Classes\CLSID) mapped to unprivileged binary paths.
• Driver Drops: SHA-256 matches for known vulnerable signed drivers (e.g., HW.sys) dropped into standard staging folders to facilitate exploitation.

The tool checks host configurations systematically across pre-defined directories:

1. Chromium Profile Paths: %LOCALAPPDATA%\<vendor>\User Data on Windows, ~/Library/Application Support/<vendor> on macOS, and ~/.config/<vendor> on Linux.
2. Firefox Records: Standard profile folders, disk cache entries, and connection telemetry stores.
3. Windows Resolver Cache: Active local DNS cache entries along with historical event logs up to the newest 50,000 records.
4. Local Storage Engine: Vivaldi, Brave, Edge, and base Chromium local database tables.

That said, there's a major operational limitation built directly into the operating system itself.

Step-by-Step Scan Execution and Pattern Verification

Executing a audit requires choosing the right balance between speed, file depth, and forensic footprint. Defenders can execute Zero Breach in three distinct operational modes based on target scenario requirements.

# Standard comprehensive scan
python -X utf8 zero-breach.py

# High-speed initial triage (skips heavy file hashing)
python -X utf8 zero-breach.py --quick

# Export structured JSON for SIEM ingestion
python -X utf8 zero-breach.py --json audit-report.json

For deep inspection involving pattern checks, set up a dedicated virtual environment to isolate the YARA-X pattern engine package. This isolated environment prevents host dependency pollution while enabling deep rule evaluation.

# Set up pattern engine environment on Windows
python -m venv .venv
.\.venv\Scripts\python.exe -m pip install -r requirements-patterns.txt
.\.venv\Scripts\python.exe -X utf8 zero-breach.py --patterns

When invoking --patterns without setting an explicit --pattern-path, the scanner automatically locates and scans up to 128 local executable files referenced by current per-user COM registrations. If an attacker configured a COM hijack for persistence, this step isolates the target executable file instantly for signature evaluation.

Here is where many security teams get tripped up: assuming a scan covers every installed software component.

Detection Capabilities vs Limitations

Understanding what a local tool cannot detect is just as critical as analyzing its detection output. Commercial spyware like Candiru is specifically engineered to eliminate local forensic footprints. Log entries drop off automatically, cache files rotate out, and volatile memory allocations vanish upon reboot.

Standard Windows installations do not record DNS resolution history unless explicitly enabled by an administrator via Operational log policies (Event ID 3008/1014). If DNS history logging was disabled during the exposure window, Zero Breach reports the history as unavailable. It cannot recover network queries that the operating system never recorded.

If you ask how to check for spyware indicators without admin rights, Zero Breach provides an effective first layer of visibility. But a zero-match scan result is not a clean bill of health. High-risk targets—such as journalists, civil rights activists, or political organizations—who suspect active targeting must seek full forensic device imaging from professional entities like the Access Now Digital Security Helpline or the Amnesty International Security Lab.

Frequently Asked Questions

What is the primary role of a Candiru spyware scanner?

A Candiru spyware scanner reads local host artifacts, browser caches, and registry persistence points to identify known indicators of the AdFection spyware campaign. It evaluates locally stored data without making network requests, minimizing the risk of alerting threat actors while establishing a preliminary timeline of exposure.

How to check for spyware indicators without admin rights?

You can run read-only scripts like Zero Breach using standard Python execution commands. By limiting the audit scope to user-writable directories, local browser profiles, and per-user registry hives (HKCU), the script extracts actionable forensic indicators without needing elevated administrator privileges or altering system configurations.

Why does a clean scan result not guarantee a device is clean?

Commercial zero-click spyware actively wipes local traces, suppresses logging, and operates out of volatile RAM. Furthermore, DNS resolution logs expire quickly or may be disabled entirely on Windows hosts. A no-match result simply indicates that published indicators were not present in the surviving local records.

Which browsers does Zero Breach inspect for AdFection traces?

Zero Breach inspects profile directories for Google Chrome, Microsoft Edge, Brave, Vivaldi, Chromium, and Mozilla Firefox. Specialized or unlisted Chromium variants like Arc and Opera, along with custom profile installation paths, are not currently parsed and must be manually reviewed during formal investigations.

Actionable Triage Next Steps

Run the base Zero Breach script across high-risk endpoints this week to establish your organization's exposure baseline against recent Citizen Lab Candiru IOC detection parameters. Ensure all browser processes are completely closed before launching the audit script to avoid SQLite access errors. If a scan returns confirmed connection matches or suspicious user-level COM registrations, immediately isolate the physical endpoint from local subnets and preserve volatile host memory for deep analysis. For teams managing broader exposure risks, review our analysis on Endpoint Incident Response Planning and Hardening Browsers Against Zero-Click Exploits to strengthen your defenses against Controlium RTB ad bidding exploit campaigns.