Copyright protected content copied from PhoneWorld website.
Pakistan ranks second worldwide in advertising bids linked to an Israeli spyware campaign that used online ads to reach devices, according to an October 15 report by Citizen Lab, a research group at the University of Toronto.
Behind every ad on a webpage is a fast auction. Advertisers bid for the slot in a fraction of a second, and the winner’s ad loads on your screen. Citizen Lab says one company used that process to carry code that could infect devices without the user clicking anything.
How the AdFection technique works
The report names the Israeli company Discover-Tech as the operator. According to the researchers, it acted as an intermediary between spyware developers and online advertising platforms.
Citizen Lab calls the method “AdFection.” The ads contained scripts that could deliver attack code to selected devices. The researchers linked the operation to spyware built by Candiru, another Israeli company, now known as Integrity Labs.
Candiru is not a new name in this field. The US Commerce Department added it to its Entity List in 2021, restricting American firms from doing business with it.
Pakistan’s numbers
Citizen Lab examined nearly four billion advertising bidding records from Discover-Tech’s system, covering March to June 2026. About 19% of those bids involved ads with scripts capable of delivering attack code.
Pakistan recorded around 139 million of them. Only Yemen, with roughly 457 million, ranked higher.
By that rough measure, Yemen and Pakistan together account for close to four in five flagged bids. The campaign’s footprint was concentrated, not spread evenly across the globe.
A local tech site and government networks
The researchers found the ads appeared more than 100,000 times on WhatMobile.com.pk, a Pakistani technology website. The report, as reported, does not allege that the site knew about or took part in the operation. Ads reach publishers through automated systems, and a site rarely vets each advertiser behind them.
That detail matters for Pakistani readers because the exposure sat on an ordinary page where people read phone specs and prices. No suspicious download or unfamiliar link was involved.
Citizen Lab also found the ads on government-operated networks in Pakistan, among other countries. It did not say which Pakistani networks were involved. Without names, administrators cannot tell from the report alone whether they were affected.
Al Jazeera devices and the Candiru link
The report ties the technique to real targets. Researchers found at least 45 Al Jazeera devices were targeted through this method during 2024 and 2025. They attributed those attacks to Candiru with high confidence.
The campaign’s reach was not limited to media organisations. Discover-Tech’s ads also reached networks linked to NATO, the United Nations, the European Parliament and government ministries in several countries.
The user called “Pindi”
Citizen Lab identified a user named “Pindi” who accessed Discover-Tech’s control platform only from Pakistan. It could not establish whether the account was connected to any spyware company.
Two other unattributed users logged in from India and Italy. The report states that login locations show only where someone accessed the system. They do not show whether people in those countries were targeted.
Seeing an ad is not the same as being hacked
Citizen Lab was direct on this point. A suspicious ad on a screen does not mean the device was infected. An ad impression cannot show that a user was singled out, and the bidding records do not identify any individual in Pakistan.
The researchers still called for investigations into whether devices on affected networks were compromised. Their reasoning is simple: the scale of exposure is too large to ignore.
For ordinary users, the practical steps are routine. Keep the phone’s operating system and browser updated, since this kind of code depends on unpatched flaws. A content blocker also cuts the number of ads a device loads at all. Neither is a guarantee, and neither comes from the report itself.
What the industry did
After the investigation, Google removed Discover-Tech from its advertising platforms. IAB Europe, an industry body for digital advertising, removed it from its approved vendor list. Other advertising companies restricted its access.
Those steps close one operator. Citizen Lab argues the weakness sits in the wider advertising system, which can let spyware companies identify and monitor users without their knowledge.
Bottom line
The 139 million figure measures exposure in the ad pipeline. It does not measure victims, and the report is careful to say so. That gap is where the Pakistani story stands for now.
Two questions remain unanswered in public. Which government networks saw these ads, and did anyone check the devices on them? Citizen Lab asked for that work. Pakistan’s regulators and network administrators are the ones positioned to do it.
Local publishers have a smaller but real stake. A site that carries programmatic ads has little visibility into what its advertisers deliver. This episode gives Pakistani publishers a reason to ask their ad partners how they screen for malicious code before a researcher asks it for them.
The post Pakistan Logged 139 Million Ad Bids Tied to Israeli Spyware Delivery-Citizen Lab Report appeared first on PhoneWorld.