Skip to content
National CERT Warns of Zero-Click Spyware via Online Ads

National CERT Warns of Zero-Click Spyware via Online Ads

First seen 26 Oct 2026, 11:41 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 26, 2026 at 19:33 UTC
  • •AdFection spyware can install without user action, targeting sensitive devices.
  • •Devices linked to Al Jazeera were reportedly infected with Candiru spyware.
  • •National CERT recommends enhanced security practices for mobile users and organizations.

National CERT issued a warning regarding a spyware delivery method called 'AdFection' that exploits digital advertising infrastructure to potentially install malware on devices without user interaction. This advisory follows a report from Citizen Lab on October 15, 2026, which confirmed that devices associated with Al Jazeera were targeted and infected with Candiru spyware. The spyware can access sensitive information such as messages, contacts, and files, posing significant risks to journalists, government officials, and organizations handling sensitive data. Detection of such attacks is challenging, as they may not exhibit the typical signs of phishing or malware delivery. Recommendations include keeping software updated, using trusted applications, and employing ad-blocking tools, although these measures do not guarantee complete protection. Organizations are advised to maintain device inventories and security logs to assist in investigations of suspected attacks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1h ago How this analysis works

Timeline

2026-10-15
Citizen Lab reports on AdFection technique
Citizen Lab published findings on the AdFection spyware delivery method, linking it to infections at Al Jazeera.
Phoneworld.Pk
2026-10-26
National CERT issues warning
National CERT released an advisory about the risks of zero-click spyware delivered via online ads.
Techjuice.Pk

More articles in this cluster (3)

Following this threat?

Track Candiru and Al Jazeera in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 2

Common questions

What is the AdFection technique?
AdFection is a spyware delivery method that exploits digital advertising infrastructure to install malware without user interaction.
Who is at risk from this spyware?
Individuals and organizations handling sensitive information, including journalists and government officials, are particularly at risk.
What actions should organizations take?
Organizations should update their security practices, maintain device inventories, and preserve security logs to investigate potential attacks.