Zero-Click Spyware: How Silent Phone Attacks Work

AI Security Awareness Training helps organizations understand emerging cyber threats and prepare employees to recognize suspicious activity without assuming that every attack can be stopped through human judgment. A report published by Citizen Lab on October 15, 2026, and subsequent reporting by BleepingComputer described how targeted online advertisements were used to deliver Candiru spyware in zero-click attacks against devices associated with Al Jazeera Media Network. The findings reveal an important distinction for security teams: some attacks exploit human decisions, while others can compromise devices without requiring a person to click anything.

The incident, described by researchers as AdFection, raises questions about online advertising, device security, privacy, and the limits of traditional security awareness programs. Understanding these risks can help CISOs, IT teams, and awareness managers build more realistic training while maintaining the technical controls necessary to defend against advanced spyware.

What Happened in the Candiru Zero-Click Spyware Attack?

According to BleepingComputer’s report on the targeted advertising campaign, researchers from Citizen Lab investigated attacks in which malicious code embedded in online advertisements was used to deliver Candiru spyware.

Reference: https://www.bleepingcomputer.com/news/security/zero-click-attacks-used-targeted-ads-to-deliver-candiru-spyware

Citizen Lab reported that at least 45 devices at Al Jazeera were targeted between 2024 and 2025, with evidence indicating that the devices were infected. Researchers traced a sequence of network communications connecting Discover-Tech advertising infrastructure, Candiru validation servers, and spyware command-and-control infrastructure.

The investigation described a system in which advertising technology helped identify selected devices and determine whether they should receive additional code. Other devices could encounter the same advertising environment without receiving the malicious payload.

The scale of the advertising activity was substantial. Citizen Lab reported that Discover-Tech placed approximately 3.77 billion advertising bids and won 442 million auctions between March and June 2026. Ads associated with the investigated infrastructure appeared across more than 120,000 websites and 75,000 mobile applications. These figures describe advertising activity and potential exposure, not confirmed spyware infections.

The findings establish that online advertising can be abused as a delivery channel for targeted surveillance. They do not establish that every advertisement, website, or application involved infected its visitors.

How Zero-Click Attacks Deliver Spyware Without a Click

A zero-click attack is an attack that can compromise a device without requiring the target to click a link, open an attachment, or otherwise interact with a malicious prompt. Depending on the technique, an attacker may exploit a vulnerability in software that automatically processes incoming content or data.

In the AdFection case, researchers reported that malicious code within selected advertisements could initiate a sequence leading to spyware delivery when the advertisements were rendered on a targeted device.

This differs from conventional phishing, which commonly relies on persuading a recipient to take an action such as opening a document, visiting a fake login page, or disclosing credentials.

The distinction matters because security awareness training cannot prevent every zero-click exploit. Even an employee who recognizes suspicious messages and follows security policies may use a device vulnerable to an exploit delivered through an advertising system.

Effective protection therefore requires several complementary layers:

• Device security: Keep operating systems, browsers, and applications updated, and apply security fixes promptly.
• Technical monitoring: Use appropriate endpoint protection, mobile-device management, and network monitoring to investigate suspicious activity.
• Advertising and privacy controls: Assess the risks associated with third-party advertising, tracking, and unnecessary permissions.
• Security awareness: Teach employees to recognize social engineering, report suspicious behavior, and follow procedures for protecting sensitive information.
• Incident response: Establish processes for investigating suspected spyware infections, preserving evidence, and escalating concerns.

These controls address different parts of the attack surface. Awareness training supports safer decisions, but it does not substitute for vulnerability management, endpoint protection, or specialist investigation.

Why Targeted Advertising Creates a Security Challenge

Digital advertising systems are designed to deliver relevant content to selected audiences. They may use information such as approximate location, device identifiers, browsing-related signals, and advertising preferences to determine which advertisements appear to a user.

In the AdFection investigation, researchers described how advertising infrastructure was allegedly used to profile and identify selected devices for spyware delivery. This illustrates how legitimate online systems can be repurposed for surveillance when malicious actors gain access to, or abuse, parts of the advertising ecosystem.

The concern extends beyond conventional workplace phishing. Employees do not need to respond to a fraudulent email for an advertising-based exploit to become relevant to their device security.

Organizations should consider the following questions:

• Are corporate devices configured with appropriate browser and operating-system protections?
• Are employees using unmanaged devices to access sensitive business information?
• Are mobile applications requesting permissions that exceed their legitimate business needs?
• Can security teams investigate unusual device or network activity?
• Do employees know how to report unexpected device behavior without attempting risky self-diagnosis?

A Cybersecurity Training Platform can help communicate these responsibilities through role-appropriate lessons. However, organizations must avoid implying that employees are responsible for detecting every technical exploit. Security teams should explain what staff can reasonably recognize and which situations require technical investigation.

What Employees Can Learn From the AdFection Spyware Findings

The primary lesson is not that employees should stop using online advertisements or assume every website is malicious. Instead, organizations should teach practical security behaviors while explaining that sophisticated attacks may bypass visible warning signs.

Recognize suspicious requests and unexpected changes

Although AdFection was not a conventional phishing campaign, spyware incidents can coincide with other forms of social engineering. Attackers may attempt to exploit public concern about a security incident through fake software updates, fraudulent support messages, or deceptive security alerts.

Employees should be cautious when a website or message unexpectedly asks them to:

• Install an unfamiliar application or browser extension.
• Disable security settings to access content.
• Enter corporate credentials into an unexpected login page.
• Approve an authentication request they did not initiate.
• Follow instructions from an unverified technical support contact.

These warning signs are useful for detecting many human-targeted attacks, but their absence does not establish that a device is safe from zero-click exploitation.

Understand how to detect phishing websites

Knowing how to detect phishing websites remains an essential skill, even when the incident under discussion involves advertising-based spyware.

Cyberfrog platform

Train people for the attacks they actually face.

Build stronger habits with phishing, vishing, smishing, deepfake and immersive 3D simulations employees remember.

Book a demoSee the attacks

Employees should check the complete domain name, verify that the destination matches the service they intended to use, and avoid entering credentials after following unexpected links. HTTPS alone does not establish that a website is legitimate, and a familiar logo does not prove that a login page belongs to the organization it claims to represent.

When a message requests sensitive information or an unusual action, employees should verify it through a previously established communication channel rather than relying on contact details supplied in the suspicious message.

For more practical guidance, Cyberfrog’s article on building stronger cybersecurity habits through security awareness training explains how organizations can reinforce safer responses to common threats.

How AI Security Awareness Training Addresses Emerging Threats

AI Security Awareness Training can help organizations turn current security research into understandable lessons, relevant workplace scenarios, and repeatable learning activities.

For the AdFection incident, a training program could explain the difference between a phishing attack requiring employee interaction and a zero-click exploit that may operate without it. This helps employees understand both their responsibilities and the limitations of individual vigilance.

AI may also assist with creating or adapting learning content, but generated material requires human review. Training must accurately reflect the available evidence, distinguish confirmed findings from assumptions, and avoid presenting speculative attack scenarios as established facts.

A practical learning program could include three elements.

1. Incident-based education

Provide a short lesson explaining the reported attack, its advertising delivery mechanism, and the distinction between zero-click exploitation and social engineering. Include specific actions employees should take when they suspect a device or account may be compromised.

2. Controlled phishing simulations

Use authorized simulated phishing exercises to evaluate how employees respond to deceptive messages, suspicious links, and fraudulent software-update requests. These exercises can measure responses to human-targeted scenarios, but they cannot reproduce or validate protection against the technical exploit described in AdFection.

Cyberfrog’s AI-powered security awareness training platform positions awareness education alongside phishing simulations. Organizations should evaluate the platform’s current access arrangements and capabilities against their training objectives before deployment.

3. Timely reinforcement

Follow training with concise reminders and additional learning based on observed needs. Employees who struggle with identifying suspicious login pages may need different guidance from administrators responsible for mobile-device management or browser security.

The objective is to improve practical decision-making, not to suggest that completing a course makes someone immune to advanced attacks.

For further reading, Cyberfrog’s article on why modern security awareness training needs to feel realistic explores the value of contextual learning and realistic scenarios.

What Security Teams Should Measure Beyond Training Completion

An effective awareness program should assess whether employees understand relevant risks and follow appropriate procedures. Completing a course is evidence of participation, not proof of improved behavior or protection against spyware.

For an incident such as AdFection, security and awareness teams can evaluate several complementary indicators.

• Training completion: Whether employees completed assigned learning activities.
• Knowledge assessment: Whether participants understand zero-click attacks, phishing, and the limits of individual responsibility.
• Reporting behavior: Whether employees report suspicious communications and unexpected device activity through approved channels.
• Simulation outcomes: How employees respond to authorized phishing scenarios relevant to their roles.
• Behavioral trends: Whether employees demonstrate improvement across repeated learning activities over time.

A simulated phishing click does not prove an employee would be compromised in a real attack. Likewise, a low click rate does not demonstrate that an organization is protected against zero-click spyware.

The objective is to identify learning opportunities, improve reporting, and help employees make safer decisions without blaming individuals for technical vulnerabilities beyond their control.

Organizations can also consider dark web exposure monitoring for employees where appropriate, particularly when investigating whether credentials or other organizational information have appeared in exposed datasets. Such monitoring may provide useful context for account-protection decisions, but it cannot independently establish whether a device was infected by Candiru spyware.

Practical Steps to Reduce Zero-Click and Social Engineering Risks

Security leaders should combine employee education with technical safeguards and clear incident-response procedures.

A practical checklist includes:

• Apply operating-system, browser, and application security updates promptly.
• Enforce appropriate device-management and endpoint-protection policies.
• Restrict unnecessary application permissions and review mobile-device configurations.
• Evaluate advertising and third-party tracking risks on corporate devices.
• Train employees to identify suspicious software requests, fake login pages, and fraudulent support messages.
• Provide a clear process for reporting unexpected device behavior.
• Establish procedures for investigating suspected spyware infections.
• Use authorized phishing simulations to practice responses to human-targeted attacks.
• Adapt learning materials to employee roles and observed training needs.
• Review behavioral trends without treating a single metric as proof of individual risk.

For the technical investigation, the Citizen Lab AdFection report provides primary research on the spyware delivery mechanism, its advertising infrastructure, and recommended defensive measures. Security teams should use the report to inform their risk assessments while consulting their own vendors and incident responders for environment-specific guidance.

The wider lesson is that sophisticated attacks require layered defenses. Employees should understand how to respond to the threats they can reasonably recognize, while security teams remain responsible for maintaining technical controls that address threats employees may never see.

Prepare Employees for the Security Threats They Actually Face

The Candiru spyware findings demonstrate why cybersecurity education must evolve alongside attack techniques. Conventional phishing awareness remains necessary, but organizations should also teach employees about emerging risks without suggesting that awareness alone can prevent technical exploitation.

Cyberfrog positions its offering around AI-powered security awareness training and phishing simulations, helping organizations explore practical approaches to employee education and human risk management. Visit the Cyberfrog website to review its current platform information and access options. Building a stronger security culture starts with realistic education, clear reporting procedures, and technical safeguards that work together.

Disclaimer: Cyberfrogsecurity reports on publicly available threat-intelligence sources. Inclusion of an organization in an article does not imply confirmed compromise. All claims are attributed to external sources unless explicitly verified.