Pakistan recorded the second-highest number of advertising bids linked to an Israeli spyware delivery operation, according to an October 15 report by Citizen Lab, a research group at the University of Toronto.
The investigation found that an Israeli company called Discover-Tech used online advertisements to deliver malicious code capable of infecting devices without requiring users to click on the ads.
Citizen Lab identified the technique as “AdFection” and linked the operation to spyware developed by another Israeli company, Candiru, now known as Integrity Labs.
Pakistan Records 139 Million Ad Bids
Citizen Lab examined nearly four billion advertising bidding records from Discover-Tech’s system between March and June 2026.
Researchers found that approximately 19% of the bids involved advertisements containing scripts capable of delivering attack code to selected devices.
Pakistan ranked second globally with around 139 million such bids, behind Yemen, which recorded approximately 457 million.
The researchers also found that the advertisements appeared more than 100,000 times on Pakistani technology website WhatMobile.com.pk.
Additionally, Pakistan was among the countries where these advertisements appeared on government-operated networks. However, the report did not identify the Pakistani networks involved.
Al Jazeera Devices Targeted
According to Citizen Lab, Discover-Tech acted as an intermediary between spyware developers and online advertising platforms.
The company allegedly used advertising infrastructure to distribute spyware developed by Candiru.
Researchers found that at least 45 devices belonging to Al Jazeera were targeted through this method during 2024 and 2025.
Citizen Lab attributed the attacks to Candiru with high confidence.
Pakistani User Identified
The investigation also identified a user named “Pindi” who accessed Discover-Tech’s control platform exclusively from Pakistan.
However, Citizen Lab could not establish whether the account was connected to any spyware company.
Researchers also identified two other unattributed users who accessed the platform from India and Italy.
The report clarified that login locations only indicate where users accessed the system and do not establish whether individuals in those countries were targeted.
Ad Exposure Does Not Confirm Infection
Citizen Lab clarified that displaying a suspicious advertisement does not automatically mean a device was hacked.
The researchers said an ad impression alone cannot establish whether a user was specifically targeted or infected with spyware.
Similarly, the bidding records do not identify individuals in Pakistan who may have been selected for surveillance.
However, the researchers warned that the large number of suspicious advertisements highlights potential security risks and called for investigations to determine whether devices on affected networks were compromised.
Global Networks Also Exposed
The investigation found that Discover-Tech’s advertisements also reached networks associated with NATO, the United Nations, the European Parliament, and government ministries in several countries.
Citizen Lab warned that the wider online advertising system could allow spyware companies to identify and monitor users without their knowledge.
Following the investigation, Google removed Discover-Tech from its advertising platforms, while IAB Europe removed the company from its approved vendor list. Other advertising companies also restricted its access.
The researchers stressed that the findings demonstrate weaknesses in the online advertising industry and the need for stronger safeguards against spyware attacks.
The post Pakistan Among Most Targeted Countries in Israeli Spyware Campaign appeared first on ProPakistani.
