The National CERT warned on Tuesday that targeted online advertisements could be used to install sophisticated spyware on mobile phones without any user clicking, opening attachments or taking deliberate steps, potentially exposing private communications and data.
In its advisory, the agency described a delivery method called "AdFection" that abuses digital ad infrastructure and real-time bidding to profile users and potentially push malicious code to selected devices.
The warning follows research released by Citizen Lab on October 15, 2026, which documented the method and reported a high-confidence finding that devices at Al Jazeera were targeted and infected with Candiru spyware via this approach.
National CERT stressed that merely seeing an advertisement does not prove a device has been targeted, exploited or infected.
Unlike typical phishing that depends on users clicking harmful links or opening infected files, a zero-click attack can deliver code through an ad or its infrastructure, trying to exploit flaws in the operating system, browser or apps without any user interaction.
The advisory outlines a possible chain: ad delivery, device profiling, target selection, malicious code delivery and vulnerability exploitation before spyware gains access to the device.
If successful, the intrusion could reveal messages, contacts, photos, files, account details and other sensitive information, depending on the spyware's reach. The risk extends to individuals and organisations handling government, corporate, research or media data.
National CERT noted that such attacks are hard to spot because they may not look like conventional phishing or malware. While avoiding suspicious links and attachments remains good practice, it may not stop every zero-click attack.
Recommendations include keeping operating systems, browsers and apps up to date, using devices that still receive security patches, installing apps only from trusted sources and regularly reviewing app permissions.
The agency also advised organisations to consider reputable ad-blocking and browser-level protections, while maintaining device-management and endpoint-security controls, though these steps cannot guarantee protection against sophisticated targeted attacks.
For incident investigation, organisations should preserve historical DNS, firewall, proxy, web-gateway and endpoint-detection logs, keep inventories of devices accessing sensitive systems and apply mobile-device management controls suited to their risk level.
Further guidance urges the use of strong, unique passwords, multifactor authentication and periodic checks of account recovery options, active sessions and connected devices, and recommends separating sensitive tasks from routine browsing where possible.
National CERT warned that unusual battery drain, heating or performance issues are not definitive signs of spyware, as they can stem from other causes, and that routine antivirus scans or lack of alerts do not guarantee a device is clean.
When credible signs of compromise appear, affected organisations should engage specialist incident-response or digital-forensics help and preserve evidence before resetting devices or deleting apps, as those actions could hinder investigations.
Users who receive targeted threat alerts from technology providers should verify them through official accounts or support channels instead of clicking links in unsolicited messages. National CERT advised organisations handling sensitive information to review their readiness for zero-click exploitation, targeted spyware and incident response.
