The National CERT has warned that targeted online advertisements could be exploited to deliver sophisticated spyware to mobile devices without users clicking links, opening attachments or taking any deliberate action, exposing sensitive communications and information to potential surveillance.
In an advisory issued, National CERT highlighted the risks associated with a spyware delivery technique known as “AdFection”, which exploits digital advertising infrastructure and real-time bidding systems to profile users and potentially deliver malicious code to targeted devices.
The advisory follows cybersecurity research published by Citizen Lab on October 15, 2026, which documented the technique and reported a high-confidence finding that devices at Al Jazeera had been targeted and infected with Candiru spyware through this method.
National CERT cautioned that the appearance of an advertisement alone does not establish that a device has been targeted, exploited or infected.
The technique differs from conventional phishing attacks, which typically rely on users clicking malicious links or opening infected attachments. In a zero-click attack, malicious code delivered through an advertisement or associated infrastructure may attempt to exploit vulnerabilities in a device’s operating system, browser or application without requiring user interaction.
According to the advisory, a potential attack may involve advertisement delivery, device profiling, target selection, malicious code delivery and vulnerability exploitation before spyware gains access to information on a compromised device.
Successful exploitation could expose messages, contacts, photographs, files, account information and other sensitive data, depending on the spyware’s capabilities and the level of access obtained. The threat could affect individuals and organisations handling sensitive government, corporate, research and media information.
National CERT noted that such attacks may be difficult to detect because their activity may not resemble conventional phishing or malware delivery. Traditional advice to avoid suspicious links and attachments, while still relevant, may not prevent every zero-click attack.
The advisory recommended keeping operating systems, browsers and applications updated, using devices that continue to receive security updates, installing applications only from trusted sources and reviewing application permissions regularly.
It also urged organisations to consider reputable ad-blocking and browser-level protections as additional safeguards, while maintaining device-management and endpoint-security controls. Such measures can reduce exposure but cannot guarantee protection against sophisticated targeted attacks.
For organisations, National CERT recommended preserving historical DNS, firewall, proxy, web-gateway and endpoint-detection logs to help investigate suspected incidents. Organisations were also advised to maintain inventories of devices accessing sensitive systems and consider mobile-device management controls appropriate to their risk exposure.
The advisory further recommended strong, unique passwords, multifactor authentication and periodic reviews of account recovery options, active sessions and connected devices. Sensitive activities should, where feasible, be separated from routine browsing and general-purpose device use.
National CERT cautioned against treating unusual battery consumption, device heating or performance problems as conclusive evidence of spyware, as such symptoms can have other causes. Similarly, routine antivirus scans or the absence of security alerts do not necessarily establish that a device is free from sophisticated spyware.
Where credible signs of compromise emerge, affected organisations should seek specialist incident-response or digital-forensics assistance. They should also consider preserving evidence before resetting devices or deleting applications, as these actions could undermine a formal investigation.
Users receiving targeted threat notifications from technology providers should verify them through official account or support channels rather than relying on links contained in unsolicited messages.
National CERT advised organisations handling sensitive information to review their preparedness for zero-click exploitation, targeted spyware and incident response.
