ISLAMABAD – Pakistan’s National Cyber Emergency Response Team (National CERT) has issued a warning about a sophisticated cyberattack that could allow hackers to install spyware on devices without users clicking suspicious links, downloading files or opening attachments.
The warning concerns a technique known as zero-click spyware, which can exploit online advertising systems to target individuals and potentially gain access to their private information.
Unlike conventional cyberattacks, which often require users to interact with malicious content, this method can attempt to compromise a device simply by loading a specially prepared advertisement.
The advisory follows an investigation published by the University of Toronto’s Citizen Lab on October 15, 2026, which uncovered the use of targeted advertisements to deliver commercial surveillance software.
What Is Zero-Click Spyware and How Does It Work?
Zero-click spyware refers to malicious software that can exploit security vulnerabilities without requiring any deliberate action from the victim.
In traditional phishing attacks, hackers often send suspicious links or infected attachments and attempt to convince users to open them.
However, the newly documented technique, called AdFection, uses the infrastructure behind online advertisements.
When someone visits a website or opens an application, advertising networks may hold automated auctions to decide which advertisements appear.
Researchers found that attackers could misuse this process to collect information about devices, identify particular users and deliver malicious code to selected targets.
If the code successfully exploits a vulnerability, spyware may gain access to the device without any obvious warning.
However, National CERT clarified that simply seeing an advertisement does not mean a device has been hacked.
Pakistan Among Countries Exposed to Suspicious Advertising Activity
The international investigation also highlighted significant advertising activity associated with Pakistan.
Citizen Lab analyzed nearly four billion advertising bids linked to Discover-Tech, an Israel-based company identified in the research.
According to the report, approximately 139.4 million bids associated with potentially malicious advertising scripts were geolocated to Pakistan between March and June 2026.
Pakistan ranked second after Yemen in the number of such bids recorded in the researchers’ dataset.
However, these figures represent advertising bids, not confirmed spyware infections or the number of people whose devices were compromised.
The research did not establish that 139.4 million malicious advertisements were displayed in Pakistan, nor did it confirm a comparable number of successful attacks.
Nevertheless, the findings highlight why cybersecurity authorities are increasingly concerned about the misuse of digital advertising networks.
Citizen Lab Reveals Zero-Click Spyware Attacks on Al Jazeera
The investigation provided evidence that the AdFection technique had already been used in real-world surveillance operations.
Citizen Lab reported that at least 45 devices within international news organisation Al Jazeera were targeted during attacks in 2024 and 2025.
Researchers found strong evidence linking the operation to Candiru, a commercial spyware developer.
The investigation confirmed that some devices were infected after attackers used targeted advertisements to initiate the spyware delivery process.
Researchers also recovered malicious software from a compromised Windows device.
The findings demonstrate that advertising systems can become a route for sophisticated surveillance attacks.
Following the investigation, Google and several advertising industry partners took action to restrict Discover-Tech’s access to their advertising platforms.
What Information Can Zero-Click Spyware Steal?
Successful spyware infections can expose sensitive personal and organisational information.
Depending on the malware’s capabilities and the access it obtains, compromised information may include:
- Private messages and communications.
- Saved contacts and account information.
- Personal photographs, documents and files.
- Sensitive business or government records.
- Other information accessible through a compromised device.
National CERT warned that people working with confidential information, including journalists, researchers, government officials and corporate employees, could face particular risks from targeted surveillance.
The agency also cautioned that sophisticated attacks may be difficult to identify through conventional antivirus tools.
How to Protect Your Phone From Zero-Click Spyware
National CERT has recommended several precautions to reduce the risk of targeted spyware attacks.
Steps to Reduce Zero-Click Spyware Risks
Users should keep their smartphones, computers, operating systems, browsers and applications updated with the latest security patches.
Installing applications only from trusted sources and regularly reviewing unnecessary permissions can also help reduce security risks.
The advisory further recommends using reputable ad-blocking tools and browsers that offer stronger privacy protections.
Users should consider limiting advertising tracking and avoid relying on devices that no longer receive security updates.
Strong passwords and multifactor authentication remain important for protecting online accounts, although they cannot directly prevent every device-level exploit.
None of these precautions provides complete protection against sophisticated zero-click attacks.
What Should You Do If You Suspect Spyware?
National CERT warned that unusual battery consumption, overheating or reduced device performance should not automatically be treated as evidence of hacking.
These symptoms can occur for several reasons unrelated to spyware.
Similarly, a clean antivirus scan does not necessarily rule out an advanced infection.
People who receive genuine targeted-threat notifications from technology companies should verify them through official channels.
Where there is credible evidence of compromise, organizations should seek specialist cybersecurity or digital-forensics assistance.
They should also preserve relevant records before resetting devices or deleting applications, as these actions could destroy important evidence.
Why Pakistan’s Spyware Warning Matters
The National CERT warning highlights a growing challenge for internet users in Pakistan.
Avoiding suspicious links and unknown attachments remains essential, but traditional browsing precautions may not protect against every sophisticated cyberattack.
As digital advertising becomes more closely connected to websites, applications and personal data, security experts are calling for stronger protection against tracking and malicious advertisements.
For individuals, the immediate priority is keeping devices updated, reducing unnecessary tracking and taking security alerts seriously.
For organizations handling sensitive information, the latest findings underline the importance of cybersecurity monitoring, incident-response planning and stronger device protections.
The central message is clear: An online advertisement should not automatically be considered dangerous, but a device does not always need a click to become vulnerable to an attack.
Key Points:
- National CERT has warned about zero-click spyware delivered through targeted advertisements.
- The technique, known as AdFection, may exploit devices without user interaction.
- Citizen Lab identified approximately 139.4 million suspicious advertising bids associated with Pakistan, not confirmed infections.
- Researchers confirmed spyware infections involving devices at Al Jazeera.
- Private messages, documents and sensitive information could be exposed after a successful compromise.
- Updating devices, reducing advertising tracking and using trusted security protections can lower risks.
- Seeing an online advertisement does not automatically mean a device has been hacked.
Read More:
For more such exclusive articles, follow Upfront .
