A National CERT Pakistan advisory warns that spyware can reach phones through online advertisements, in some cases without a click. The advisory, NCA-23.261026, draws on Citizen Lab research published on 15 October 2026. PhoneWorld reported it on 26 October 2026.
What the advisory describes
The advisory says AdFection can use online advertising networks to profile devices. In a targeted case, an advertisement may deliver code that tries to exploit a vulnerability. The target can be the browser, an app or the device, and a click may not be needed.
The advisory cites a Citizen Lab finding, rated high confidence, that devices at Al Jazeera were infected with Candiru spyware through this technique.
It states that an advertisement on screen does not show that a device was targeted or infected. Actual risk depends on the target, the device and its software vulnerabilities.
Measures it lists
The advisory lists keeping operating systems, browsers and apps updated, preferably with automatic updates. It also lists using devices that still receive manufacturer security updates, and replacing unsupported devices that handle sensitive information.
Other measures are installing apps from trusted sources, reviewing app permissions, and using strong, unique passwords with multifactor authentication. Organisations may add ad-blockers and browser protections. The advisory says these measures reduce risk but cannot guarantee protection against a targeted exploit.
Software support for a phone
Two of the advisory's measures concern the phone itself: current software, and a model its maker still updates. The installed security patch level appears in the phone's software information screen, and each manufacturer publishes how long it supports a model.