Can a phone be hacked by ads without you doing anything? Pakistan’s National Cyber Emergency Response Team (National CERT), the country’s cyber emergency response agency, says yes: spyware can reach a mobile device when an online advertisement simply loads, with no tap, link, or attachment involved.
In its latest advisory, National CERT said attackers are abusing digital advertising networks to go after mobiles. The risk is not limited to obvious phishing. The agency stressed that a phone hacked by ads can happen in a zero-click style attack—meaning the user may never knowingly interact with the malicious content.
How AdFection spyware reaches phones
The advisory focuses on a technique called AdFection. It allows attackers to misuse advertising systems to profile users and then deliver mercenary spyware through ads shown on websites and mobile apps.
National CERT linked the warning to research published by Citizen Lab on 15 October 2026. That work found Pakistan among the most targeted countries in the ad-based spyware campaign. Citizen Lab also documented a high-confidence case in which devices at Al Jazeera were targeted and infected with Candiru spyware using this approach.
In practice, the campaign may serve malicious code through ads, single out chosen devices, and exploit weaknesses in browsers, apps, or operating systems to gain access. National CERT also clarified an important limit: merely seeing an advertisement does not prove that a handset has been selected or compromised.
What is at risk if an infection succeeds
If spyware takes hold, National CERT warned, private chats, photos, files, account passwords, and other sensitive data could be exposed. Further harms include unauthorised surveillance, full or partial device takeover, and leaks of government, corporate, research, or media-related information.
How much damage follows depends on which flaws are used, which software version the device runs, and what the spyware is built to do. That is why a phone hacked by ads is treated as a serious privacy and security threat, even though not every displayed ad equals an infection.
How to cut the risk
For everyday users, National CERT advised keeping operating systems, browsers, and apps updated; using devices that still receive regular security patches; installing apps only from trusted sources; and turning on multi-factor authentication for important accounts.
Organisations were told to consider ad-blocking and browser-level protections, keep security logs, strengthen device monitoring, and call in specialist digital forensics help if spyware is suspected. Credible signs of spyware or targeted incidents can be reported through National CERT’s official incident-reporting channel.
Aasan alfaaz mein
National CERT ne bataya hai ke kabhi kabhi sirf online ad load hone se phone par spyware aa sakta hai, click ki zarurat nahi. Pakistan is campaign mein zyada target hone wale mulkon mein shamil hai. Is se messages, photos aur passwords khatre mein aa sakte hain. Apps aur system update rakhein, trusted stores se apps download karein, aur important accounts par multi-factor authentication on karein.
