Your phone could be infected with spyware simply by loading an online advertisement, even if you do not click it or interact with it.

Pakistan’s National Cyber Emergency Response Team (National CERT) has warned that attackers are exploiting online advertising networks to target mobile devices and deliver advanced spyware.

In its latest advisory, the agency said users do not need to open suspicious links, download attachments, or take any action for these attacks to work.

What Is AdFection?

The advisory highlights a technique called “AdFection,” through which attackers exploit digital advertising systems to identify targeted users and deliver mercenary spyware through advertisements displayed on websites and mobile apps.

The warning follows research published by Citizen Lab on October 15, 2026, which identified Pakistan among the countries targeted in an advertising-based spyware campaign.

Citizen Lab also documented a high-confidence finding that devices belonging to Al Jazeera were targeted and infected with Candiru spyware through this technique.

The attack can involve placing malicious code in advertisements, identifying specific devices, and exploiting security weaknesses in browsers, applications, or operating systems to gain access.

However, National CERT clarified that simply viewing an advertisement does not mean a device has been targeted or infected.

What Hackers Can Access

National CERT warned that a successful spyware infection could expose private messages, photographs, files, passwords, and other sensitive information.

Attackers could also use compromised devices for surveillance, gain unauthorised access, or steal government, corporate, research, and media-related information.

The extent of damage depends on the security flaws exploited, the device’s software version, and the spyware’s capabilities.

How to Protect Your Phone

National CERT has advised users to take several precautions:

• Keep mobile operating systems, browsers, and applications updated.
• Use devices that continue to receive security updates.
• Download applications only from trusted sources.
• Enable multi-factor authentication on important accounts.

The agency has also advised organisations to consider ad-blocking tools and browser-level security protections, maintain security logs, and strengthen device monitoring.

Organisations that suspect spyware infections or targeted cyberattacks should seek professional digital forensics assistance.

National CERT said credible signs of spyware activity and targeted cyber incidents can be reported through its official incident-reporting mechanism.