What Candiru's COM hijacking tells defenders about detection after the initial compromise
By Ian Davila, Director of Adversary Emulation, Tidal Cyber
TLD;R [Threat Led Defense Research]
Citizen Lab's October 2026 AdFection report shows Candiru delivering zero-click spyware through targeted ads. The delivery method is new. The persistence method is not. Both the 2021 Candiru implant and the new one hijack COM objects to survive reboots, each with a different DLL. If you hunt the behavior instead of the file, you get a second shot at this actor after the exploit lands.
About this series
Beyond the Exploit is part of Tidal Cyber's TLD;R Threat-Led Defense Research program, featuring perspectives from our researchers and technical leaders.
Each installment goes beyond the headlines to explore real-world attacks, adversary behaviors, and lessons from the field. We examine how adversaries execute attacks, why certain techniques work, and where opportunities exist for defenders to strengthen their defenses.
The goal is to turn threat intelligence and research into practical insights that help security teams identify gaps, improve detections, and continuously strengthen their defensive capabilities.
What did Citizen Lab find?
On October 15, 2026, Citizen Lab published new research on Candiru, the mercenary spyware vendor. Attackers used a targeted advertising channel to push zero-click spyware to chosen individuals. The target never had to click anything.
Most coverage will focus on the ad pipeline. Fair enough. It's a new delivery route and it deserves attention.
I read the report with a different question in mind. What does the implant do once it's on the box?
It hijacks a COM object for persistence. So did the Candiru variant Citizen Lab documented in 2021. Different samples. Different DLLs. Same Windows mechanism.
Why focus on post-exploitation if the exploit is zero-click?
Because you're unlikely to catch the exploit. Zero-click chains often rely on unknown vulnerabilities, arrive through channels you don't monitor, and leave little trace at the moment of compromise.
Getting in is step one for the attacker. Next they need to persist, run more code, reach their infrastructure, and collect data. Each of those steps writes to a log somewhere. Each one is a detection opportunity.
Candiru changed its delivery and kept its persistence. Your better odds sit after the exploit, not before it.
What is COM hijacking?
COM hijacking is MITRE ATT&CK technique T1546.015. It abuses how Windows finds and loads Component Object Model objects.
Every COM object has a class ID (CLSID) in the registry. The InprocServer32 subkey under it holds the path to the DLL Windows loads when a program calls the object. Change the path, and a legitimate process loads the attacker's DLL instead.
One common variant writes the entry under HKCU\Software\Classes\CLSID. Windows checks HKCU before HKLM, and writing there needs no admin rights. Check the sample details before assuming Candiru used this exact path.
Attackers like the technique because their code runs inside a trusted process, triggered by normal system activity.
How would you detect Candiru's COM hijacking?
Here's the hypothesis I'd test first. Correlate two events:
- A registry write setting a COM object's InprocServer32 value to a DLL path.
- A later execution of the same DLL through rundll32.exe.
Neither event means much alone. Software registers COM servers all the time. Installers and admins run rundll32.exe constantly. The signal lives in the link between the two: one DLL path showing up in a COM registration change, then in a rundll32 command line.
This is a hypothesis, not a universal Candiru detection. Citizen Lab hasn't confirmed this exact event sequence in both samples. It's where I'd start testing.
What telemetry do you need?
With Sysmon on Windows, start here:
- Event ID 13 (registry value set) for writes to InprocServer32 keys.
- Event ID 1 (process creation) for rundll32.exe with the full command line.
- Event ID 7 (image loaded) for DLLs loaded after the registry change.
- Where the registration lives, HKCU or HKLM.
- Where the DLL sits on disk. User-writable paths like AppData deserve a closer look.
- Whether the DLL is signed, and by whom.
- Which process wrote the registry change.
- How much time passed between the write and the execution.
- Which registry keys changed?
- Which DLL did the entry reference?
- How and when did the DLL load?
- Which processes took part?
- What telemetry records each step?
- What separates this from normal activity in your environment?
Most EDR platforms collect equivalent data. Confirm yours does. Confirm the fields carry full DLL paths you're able to match across events.
Then add context to separate suspicious activity from normal software:
Why does behavior beat indicators here?
Hashes, file names, domains, and tools change between campaigns. Candiru swapped DLLs between 2021 and 2026. A hash-based rule for the 2021 sample misses the new one.
The COM hijacking procedure carried over. A detection built on the behavior had a chance at both.
Behavior detections have limits too. Attackers change procedures, and legitimate software triggers similar events. No rule works forever. A procedure an actor reuses across generations still lasts longer than a hash.
ATT&CK gives you the technique name. The procedure tells you what to build. For any intrusion report, ask:
Would your team catch it today?
Reading about a behavior and detecting it are two different things. Answer four questions before you call yourself covered.
Do you collect the telemetry?
You need visibility into COM registry writes and the DLL execution or load after them.
Do you have a detection for it?
A tool capable of seeing the events is different from a rule enabled and firing.
Do you correlate with context?
Single events produce too many alerts. Correlation plus a baseline of normal activity keeps the rule precise.
Have you tested it?
Run the behavior in your environment. Run legitimate software next to it. Record what fires and what stays quiet.
Adversary emulation, detection engineering, and threat intel need to work as one team here. Mapping a report to ATT&CK is step one. Knowing whether your defenses see the behavior is the goal.
Threat-Led Defense in five steps
- Learn how the attacker executes.
- Check whether your defenses cover those behaviors.
- Find the gaps.
- Fix the gaps with the most risk first.
- Test again.
Exploit prevention and indicators still belong in your stack. This process keeps you improving when attackers change tools or delivery methods, as Candiru did here.
Read the Citizen Lab report for the ad delivery story. Then go hunt for the COM hijack.
[Insert a CTA to learn more…..or meet with our threat team]
Frequently asked questions
What is Candiru?
Candiru is a mercenary spyware vendor. Its tools target specific individuals, often through zero-click exploits. Citizen Lab has documented its implants since 2021.
How did Candiru deliver spyware through ads?
Per Citizen Lab's October 2026 report, attackers used a targeted online advertising channel to push zero-click spyware to chosen targets. The target didn't need to click.
How does Candiru maintain persistence on Windows?
Both the 2021 and 2026 Candiru implants use COM hijacking. They modify COM registry entries so a legitimate process loads a malicious DLL. Each generation used a different DLL.
What is COM hijacking in MITRE ATT&CK?
COM hijacking is T1546.015, Component Object Model Hijacking, under Event Triggered Execution. Attackers use it for persistence and privilege escalation.
How do you detect COM hijacking?
Monitor writes to InprocServer32 registry values, especially under HKCU\Software\Classes\CLSID. Correlate those writes with later loads or rundll32.exe execution of the same DLL. Add context on DLL location, signature, and the process behind the change.
Is it possible to stop zero-click spyware at the exploit stage?
Rarely. Unknown vulnerabilities and unmonitored delivery channels make it hard. Post-exploitation behaviors like persistence give you more reliable detection points.
About the author
Ian Davila is Director of Adversary Emulation at Tidal Cyber. He studies real-world adversary behavior and turns it into defensive improvements.
Further reading
Citizen Lab, Exposing AdFection, October 15, 2026. Read the report