Ad Spyware Warning: No Click Needed, Says CERT
A phone can be infected with spyware simply by loading an online advertisement, without the user clicking anything. That is the warning from Pakistan’s National Cyber Emergency Response Team (National CERT) in its latest advisory.
The advisory says attackers are exploiting online advertising networks to target mobile devices. Users do not need to click a suspicious link, open an attachment or take any action for the attack to work. The warning matters because it removes the usual safety rule that people repeat to each other: do not click strange links. In this case, there is no link to avoid.
What is AdFection
The advisory highlights a technique known as AdFection. It lets attackers misuse digital advertising systems to profile users and deliver mercenary spyware through ads shown on websites and mobile apps.
The warning is based on research published by Citizen Lab on October 15, 2026. The same research found that Pakistan was among the most targeted countries in the ad-based spyware campaign.
According to the advisory, Citizen Lab documented a high-confidence finding that devices at Al Jazeera were targeted and infected with Candiru spyware using this method. The attack may involve delivering malicious code through ads, picking out selected devices, and exploiting flaws in browsers, apps or operating systems to gain access.
National CERT also made an important clarification. Simply seeing an advertisement does not confirm that a device has been targeted or compromised. Most ads are ordinary commercial messages. The danger lies in a small number of malicious ads that exploit software flaws, and users cannot tell them apart by looking at them.
What is at risk
A successful infection could expose private communications, photos, files, account passwords and other sensitive data, National CERT warned. It also flagged risks of unauthorised surveillance, device takeover and leaks of government, corporate, research and media-related information.
The actual damage depends on the flaws exploited, the device’s software version and the spyware’s capabilities. That is why the same ad can be harmless on a fully updated phone and dangerous on a phone running old software. Attackers look for devices that have not received recent security fixes, because known flaws give them a way in.
For Pakistan, the risk is not abstract. The country has a large mobile-first population, and many people use older handsets or delay updates because of storage space, data costs or habit. Journalists, officials, researchers and businesspeople handle sensitive material on the same phones they use for everyday browsing, which is why a warning aimed at the general public also matters for institutions.
How to stay safe
National CERT advised users to keep operating systems, browsers and apps updated, and to use devices that still receive regular security updates. It also advised installing apps only from trusted sources and turning on multi-factor authentication for important accounts.
Those steps sound basic, but they are the ones that close the flaws this kind of attack needs. An update often contains a fix for a flaw that attackers are already using. A phone that no longer receives updates cannot receive that fix, whatever its owner does.
Organisations were advised to consider ad-blocking and browser-level protections, preserve security logs, strengthen device monitoring and seek specialist digital forensics help in suspected cases. The agency said credible signs of spyware activity or targeted cyber incidents can be reported through its official incident-reporting mechanism.
Part of a wider pattern
This is not the first cyber warning to reach Pakistani users this month. National CERT has previously warned about hacked systems and restoration risks, covered in our report on the CERT warning on hacked systems, and the National Cyber Emergency Response Team has flagged a critical flaw affecting websites, covered in our report on the PHP warning. Online fraud has also stayed active, covered in our report on the PTA fraud warning.
The new advisory differs from those warnings in one respect. It does not ask users to spot a scam message or avoid a fake website. It asks them to keep their devices updated and to treat ad-supported browsing as a surface that needs protection, especially on phones that hold work and personal life together.
For most users, the practical steps are short. Update the phone and its apps, remove apps that are no longer supported, keep multi-factor authentication on for email and banking, and do not ignore a security update because it arrives at an inconvenient time. For organisations, the advisory points to a second step: monitoring and logging, so that a suspected infection can be investigated rather than guessed at.
