Pakistan’s National Cyber Emergency Response Team has warned phone users that spyware can now reach a handset through an ordinary online advertisement — without the owner tapping or clicking anything at all. The advisory, reported on 30 October 2026, describes a technique researchers call AdFection spyware delivery, in which targeted ads act as the carrier that installs spyware on a phone.
For most Pakistanis, this changes the most basic rule of smartphone safety. The old advice — never click a strange link — is no longer enough on its own, because the attack the National CERT describes does not need a click in the first place.
What the National CERT AdFection Spyware Advisory Says
According to the advisory, targeted online ads can be used to deliver AdFection spyware to a phone without a single tap. The country’s cyber emergency response agency says the technique works through the everyday advertising pipeline that loads adverts inside apps and websites, turning a routine ad slot into a delivery channel for spyware.
The agency has aimed the warning mainly at staff who handle sensitive government, business, research or newsroom material — the people most likely to be targeted by a well-funded attacker. But National CERT’s message is relevant to every smartphone user in Pakistan: the infection route it describes is built into the normal way mobile advertising works.
How an Ad Becomes a Spyware Attack
The advisory builds on a Citizen Lab report, published on 15 October by the research group at the University of Toronto, which linked Candiru spyware to infections at the broadcaster Al Jazeera during 2024 and 2025, with at least 45 devices targeted. Citizen Lab found that an ad company called Discover-Tech sat between ad exchanges and spyware vendors, profiling users and serving ads that carried malicious scripts.
Crucially, the ads themselves carried no exploit. Citizen Lab says they carried scripts that sorted visitors — and only the chosen devices were then attacked through a bug in the browser, an app or the operating system. Every time a page or app loads, its ad slots go to auction in a fraction of a second, and that split-second window is where the AdFection spyware operation worked.
If the attack lands, the spyware can read messages, contacts, photos and files, and pick up account details. How much it collects depends on the tool and the level of access it manages to win on the device.
UrduPro earlier reported on the Citizen Lab findings that placed Pakistan second worldwide in spyware ad bids by the same Israeli-linked operation.
Where Pakistan Appears in the Citizen Lab Research
Pakistan shows up directly in the research behind the AdFection spyware warning. Citizen Lab says Discover-Tech’s ad scripts were shown more than 100,000 times on whatmobile.com.pk, a Pakistani phone-information website. It also found a Discover-Tech control-panel user, named “Pindi”, who logged in only from Pakistan — though the researchers could not tie that account to any spyware company.
After the findings were disclosed, Google and the ad-industry body IAB Europe removed Discover-Tech from their approved-vendor lists in early October, and Google cut the company’s access to its ad exchange. The full account of the advisory is reported by Tech Prolonged, and the underlying research is published by Citizen Lab.
How to Protect Your Phone: CERT’s Advice
For ordinary users, National CERT’s list of defences against AdFection spyware is short but practical. Install software updates promptly, and favour phones that still receive security patches — an out-of-support phone is the easiest target. Take apps only from trusted stores, review app permissions from time to time, and use strong, unique passwords with two-step login so that even a successful break-in causes less damage.
Offices are told to keep network and endpoint logs so any incident can be traced, to manage staff phones centrally, and to consider ad-blocking in the browser. Where a compromise looks real, National CERT says to bring in forensics specialists before wiping the phone — because a reset destroys the evidence investigators need.
What This AdFection Spyware Warning Does Not Mean
National CERT attaches an important caveat to its AdFection spyware warning: seeing a suspicious-looking ad on your screen is not evidence of an attack. The agency also says a hot or fast-draining battery proves nothing, and neither does a clean antivirus scan. Citizen Lab adds its own caution — “an ad impression alone cannot show that a particular person was targeted.”
None of the protective measures is a guarantee against a well-funded attacker, the advisory says. But keeping a phone updated, limiting app permissions and staying alert to the new AdFection spyware threat puts ordinary users far ahead of the attackers’ easiest targets.
Related Posts
TechnologyPIA Boeing 787 Dreamliner Cleared to Fly in Pakistan — First Flight PK-786 Departs London Today
TechnologyOpenAI and Google Back Shared Robots.txt AI Training Preference Signal
TechnologyOneOffice and ZIEL Global Bring Affordable Cloud Office Suite to Pakistan
TechnologyPoco X8S Launches Globally: Compact 6.35-Inch Phone With Snapdragon 7 Gen 4, 100W Charging From $399
TechnologyEcoStar Launches 100-Inch QD Mini LED TV in Pakistan — Biggest Screen, Cinema-Scale 4K
TechnologyWorld Bank Proposes $50 Million Fund of Funds for Pakistan’s StartupsMost Popular
How-ToPTA Tax Calculator 2026: Check Mobile Tax on Any Phone334 views
SportsBallon d’Or 2026: London Ceremony, Nominees and All-Time Records Ahead of 70th Anniversary320 views
SportsUEFA Champions League 2026-27: Format, Teams and Schedule320 views
Canada JobsTech Jobs in Canada: Roles, Salaries, and Skills Needed310 views
Pakistan NewsPIA Boeing 787 Lease Deal: What It Means for the Airline297 views
ShowbizWomen’s Fashion in Pakistan 2026: Trends, Brands and Style Guide296 views
