National CERT has issued a warning that spyware can infect phones through online ads without the user clicking anything. The technique is called AdFection, and the zero-click ad spyware AdFection model matters because it removes the one defense most people rely on: not tapping suspicious things. This post explains what is known, how this class of attack works, and where a VPN fits in.

What National CERT Is Warning About

According to the report on the warning, National CERT says a phone can be compromised simply by loading an ad. No tap, no download prompt, no fake login page. The technique carries the name AdFection.

The warning follows research reported in mid-October 2026. Search coverage attributes the findings to Citizen Lab, whose researchers described AdFection as a cyber espionage technique. Those summaries say the research linked an ad company called Discover-Tech to mercenary spyware vendors, naming Candiru and Bindecy, and that Al Jazeera devices were among those targeted. We have not independently verified those details, so treat them as the reported findings of that research rather than established fact.

The key point for ordinary readers is the delivery method. The attack arrives through the same advertising pipeline that serves banners and video ads in apps and websites.

How a Zero-Click Ad Attack Works

The source article is brief on mechanics, but the research summaries offer a useful outline. They describe the attackers exploiting the real-time bidding ecosystem, the automated auction that decides which ad appears on your screen in the fraction of a second before a page or app loads.

In simplified terms, the reported sequence looks like this:

  • Targeting: an operator picks a specific person or device they want to reach.
  • Fingerprinting: the ad system is used to recognize that device, based on the kind of information ads normally collect.
  • Delivery: when the targeted device loads an ad, a malicious payload is served instead of, or alongside, normal content.
  • Infection: if the device has an exploitable flaw, spyware can install without any interaction.

This is why the attack is described as zero-click. The victim does nothing unusual. They are just browsing or using an app that shows ads. The research summaries stress that this approach is aimed at specific individuals, which fits the pattern of commercial spyware rather than mass malware. Still, a public warning from a national CERT signals that the technique is worth taking seriously well beyond journalists and activists.

Where a VPN Helps and Where It Doesn't

This story is a good reminder of what a VPN actually does. A VPN encrypts the traffic between your device and the VPN server, and it hides your IP address from the sites you visit. That is genuinely useful on public Wi-Fi and for limiting some kinds of tracking.

What a VPN does not do is inspect or block the content that arrives through that encrypted tunnel. If a malicious ad payload is delivered to your phone, the VPN carries it just like any other data. It does not remove the vulnerability the payload targets, and it does not stop an ad network from serving the ad. Hiding your IP also does little against the device fingerprinting that the research summaries describe, since that relies on other signals.

There is a small exception worth stating carefully: some VPN apps bundle optional ad or tracker blocking. That is a separate feature from the encrypted tunnel itself, and its effectiveness varies. If you rely on it, check that it is switched on and keep it in perspective.

The broader lesson is about trust at different layers. Encryption protects data in transit, but it says nothing about whether the content being delivered is safe. We looked at a related trust question in our piece on TLS certificate revocation and the GlobalSign fallout, which shows how many separate mechanisms sit between you and a website.

What iPhone, iPad and Windows Users Should Do Now

The National CERT summary we have does not list specific vulnerabilities or affected software versions, so we will not guess at them. The following steps are general, low-cost, and sensible in light of this kind of threat.

iPhone and iPad

  • Install the latest iOS or iPadOS update. Zero-click attacks depend on unpatched flaws, so updates are the most direct protection.
  • Consider turning on Lockdown Mode if you are at elevated risk, such as a journalist, activist, or someone handling sensitive work. It reduces functionality in exchange for a smaller attack surface.
  • Limit ad personalization in your privacy settings to reduce the data ads can use.

Windows

  • Run Windows Update and update your browser, since browsers are where ads load.
  • Use a reputable content blocker or browser setting that blocks ads and trackers.
  • Keep built-in security tools enabled.

Android and other devices

  • The same logic applies: install system and browser updates promptly and use ad or content blocking.

What This Means For You

Most people are unlikely to be the intended target of mercenary spyware. But the delivery channel, online advertising, is one everyone shares, and the defenses are simple enough to adopt regardless of your risk level. The practical takeaway is that the strongest protections here are boring ones: patched software and fewer ads reaching your device.

A VPN remains a worthwhile privacy tool for what it is designed to do. It just should not be treated as protection against malicious ads.

Actionable Takeaways

  • Update your phone, tablet, computer, and browser today, and enable automatic updates.
  • Turn on ad or content blocking in your browser or system settings.
  • Reduce ad personalization to limit fingerprinting data.
  • If you are at higher risk, consider Lockdown Mode on Apple devices.
  • Treat a VPN as one layer of privacy, not a defense against zero-click ad spyware AdFection or similar attacks.

National CERT's warning is a prompt to check the basics. Ten minutes spent on updates and ad blocking does more against this threat than any amount of traffic encryption.