A report from the Citizen Lab in collaboration with the Microsoft Threat Intelligence Center documents some of the tools and sales of Candiru, a secretive Israel-based company that sells spyware to governments. "Hooking Candiru" identifies hundreds of websites linked to Candiru’s spyware infrastructure, including many fake pages for civil society entitites such as Amnesty International and the Black Lives Matter movement. The report does not identify specific targets of these websites. Microsoft observed at least 100 victims, including human rights defenders, dissidents, and journalists, in Palestine, Israel, Iran, Lebanon, Yemen, Spain, United Kingdom, Turkey, Armenia, and Singapore.

Multiple attempts by journalists to contact Candiru for comment went unanswered.