Pakistan’s National Cyber Emergency Response Team (National CERT) has told users and organisations that targeted online ads can be used to deliver spyware to a phone without a single tap. The advisory covers a technique called AdFection, which researchers described this month.
The agency adds a caveat: a suspicious-looking ad on your screen is not evidence of an attack. It is aimed mainly at staff who handle sensitive government, business, research or newsroom material.
The advisory builds on a Citizen Lab report published on 15 October. Citizen Lab, a research group at the University of Toronto, linked Candiru spyware to infections at Al Jazeera in 2024 and 2025, with at least 45 devices targeted. It says the ad company Discover-Tech sat between ad exchanges and spyware vendors, profiling users and serving ads that carried scripts.
How an ad becomes an attack
Every time a page or app loads, its ad slots go to auction in a fraction of a second. Citizen Lab says the ads here carried no exploit. They carried scripts that sorted visitors, and only chosen devices were then attacked through a bug in the browser, an app or the operating system.
If the attack lands, the spyware can read messages, contacts, photos and files, and pick up account details. How much it gets depends on the tool and the access it wins.
Where Pakistan appears in the research
Citizen Lab says Discover-Tech’s ad scripts were shown more than 100,000 times on whatmobile.com.pk, a Pakistani phone site. It also found a Discover-Tech control-panel user, named Pindi, who logged in only from Pakistan, though it could not tie the account to any spyware company. The report says an ad impression alone cannot show that a particular person was targeted.
After the findings were disclosed, Google and the ad-industry body IAB Europe removed Discover-Tech from their approved-vendor lists in early October, and Google cut its access to its ad exchange.
The advice, for individuals and offices
For ordinary users, National CERT’s list is short. Install updates promptly, favour phones that still get security patches, take apps only from trusted stores, and check permissions now and then. Strong unique passwords with two-step login limit the damage if something does get in.
Offices are told to keep network and endpoint logs so any incident can be traced, to manage staff phones centrally, and to consider ad blocking in the browser. Where compromise looks real, bring in forensics specialists before wiping a phone, because a reset destroys the evidence.
The agency also says a hot or fast-draining battery proves nothing, and neither does a clean antivirus scan. None of the measures is a guarantee against a well-funded attacker, it says.
