Watching or clicking on an ad on your mobile phone can put it at risk of being hacked.
The National Cyber Emergency Response Team (National CERT) has warned that mobile phones can be infected with spyware simply by loading an online advertisement, without users clicking on it.
In a recent advisory, the agency said attackers were exploiting digital advertising networks to profile users and deliver sophisticated spyware through adverts displayed on websites and mobile applications.
It said users did not need to click on a suspicious link, open an attachment or take any other action for the attack to succeed.
What is AdFection?
The advisory describes a technique known as “AdFection”, through which attackers misuse digital advertising systems to identify selected users and deliver mercenary spyware.
The warning draws on research published by Citizen Lab on 15 October 2026, which found that Pakistan was among the countries most targeted in an advertising-based spyware campaign.
Citizen Lab also documented what it described as a high-confidence case in which devices belonging to staff at Al Jazeera were targeted and infected with Candiru spyware using this method.
The attack can involve delivering malicious code through advertisements, identifying selected devices and exploiting vulnerabilities in browsers, applications or operating systems to gain access.
However, National CERT stressed that seeing an advertisement does not, by itself, mean a device has been targeted or compromised.
The agency warned that a successful spyware infection could give attackers access to private communications, photographs, files, passwords and other sensitive information.
It also highlighted the possibility of unauthorised surveillance, device takeover and the exposure of information belonging to government bodies, businesses, researchers and media organisations.
The extent of any damage would depend on the vulnerabilities exploited, the device’s software version and the capabilities of the spyware.
How to protect yourself from getting hacked?
National CERT advised users to keep their operating systems, browsers and applications updated, and to use devices that continue to receive regular security updates.
It also recommended downloading applications only from trusted sources and enabling multi-factor authentication on important accounts.
Organisations were urged to consider ad-blocking and browser-level security protections, retain security logs and strengthen device monitoring.
They were also advised to seek specialist digital forensics support if spyware activity was suspected.
National CERT said credible signs of spyware activity or targeted cyber incidents could be reported through its official incident-reporting mechanism.
