Pakistan Ranks Second in Exposure to Israeli Spyware-Linked Ads, Report Finds
Pakistan ranked second globally in advertising bids associated with an Israeli spyware-linked operation, raising concerns about the misuse of online advertising technology for digital surveillance. The findings come from a report published by Citizen Lab, a cybersecurity research group at the University of Toronto, which investigated how an Israeli advertising technology company allegedly helped deliver spyware through ordinary-looking online advertisements.
The investigation examined billions of advertising records and identified activity involving Pakistan, including advertisements appearing on a local website and impressions recorded on government-operated networks. However, the report does not establish that Pakistani users, officials or government employees were infected with spyware.
Pakistan Recorded Around 139 Million Advertising Bids
According to reporting on the Citizen Lab investigation, Pakistan recorded approximately 139 million advertising bids associated with the spyware-linked system between March and June 2026.
Yemen ranked first, with approximately 457 million bids, placing Pakistan second in the reported global comparison.
The researchers examined nearly four billion bidding records linked to Discover-Tech, an Israeli advertising technology company. The broader investigation found that its advertising activity extended across websites, mobile applications and networks in numerous countries.
The report also identified more than 100,000 appearances of the relevant advertisements on Pakistani website WhatMobile.com.pk. Researchers additionally found advertising impressions on networks associated with government-operated institutions in Pakistan, although the specific networks were not publicly identified.
These findings indicate substantial exposure to the advertising infrastructure under investigation. They do not, by themselves, demonstrate that every advertisement carried spyware or that a device displaying one was compromised.
What Is the AdFection Spyware Technique?
Citizen Lab calls the technique described in its October 15, 2026 report “AdFection.” It involves exploiting online advertising technology to track users and, in certain circumstances, deliver spyware without requiring the user to click an advertisement.
Online advertisements are commonly delivered through automated auctions. Advertisers compete for opportunities to display ads to users based on information available about their devices, browsing environments and advertising identifiers.
The researchers found that malicious code could be embedded in advertisements purchased through this system. When a selected advertisement appeared, code could communicate with external infrastructure and potentially initiate an attack against the device.
This is known as a zero-click attack because the victim may not need to click a link, download a file or deliberately open a suspicious attachment.
The report describes this as a significant cybersecurity concern because advertisements can appear on otherwise legitimate websites and applications.
How Discover-Tech and Candiru Were Linked to the Operation
Citizen Lab identified Discover-Tech as an intermediary connecting online advertising systems with commercial spyware and surveillance vendors.
The report linked Discover-Tech’s infrastructure to Candiru, an Israeli spyware developer that has also operated under the name Integrity Labs. According to the researchers, the advertising infrastructure helped facilitate the delivery of Candiru spyware in documented attacks.
The investigation provided technical evidence linking the system to attacks against devices used by Al Jazeera, the international news network.
Citizen Lab said at least 45 devices within Al Jazeera were targeted during 2024 and 2025. Its researchers analysed network logs supplied by the broadcaster and identified a sequence of connections consistent with spyware delivery.
These documented incidents are distinct from the findings about Pakistan. The report’s advertising records do not independently establish that the same spyware was installed on devices in Pakistan.
What the Findings Mean for Pakistan
The appearance of spyware-linked advertisements on Pakistani websites and government-operated networks raises questions about the security of the country’s digital infrastructure.
Potential risks include:
- Privacy exposure: Advertising systems can collect device identifiers and other information that may help track users across online services.
- Targeted surveillance: Sophisticated operators may use advertising identifiers and device information to select particular individuals for further scrutiny.
- Government network security: Advertising activity on government-operated networks warrants investigation, but an advertisement appearing on a network does not establish that a government system was compromised.
- Journalist and civil society safety: The confirmed attacks against Al Jazeera demonstrate why spyware delivered through advertising is a concern for journalists and other people handling sensitive information.
The findings also highlight the need for stronger oversight of advertising technology providers and improved monitoring of potentially malicious third-party code.
Did Pakistani Users Actually Get Hacked?
The available findings do not confirm that Pakistani individuals were infected with spyware through this operation.
Citizen Lab cautions that an advertising impression does not, on its own, establish targeting or infection. A bid, an advertisement being displayed, a device being selected for surveillance and a successful spyware infection are different stages of activity.
The report also identified a user account named “Pindi” that accessed Discover-Tech’s control platform exclusively from Pakistan. However, researchers could not conclusively connect that account to a spyware company. A login originating in Pakistan does not prove that the account holder was Pakistani, that the person was conducting attacks from Pakistan, or that Pakistani users were targeted.
Determining whether anyone in Pakistan was compromised would require additional technical investigation, including relevant device evidence, network logs and confirmation from affected organisations.
Advertising Platforms Take Action
Citizen Lab said it shared its findings with advertising vendors and industry organisations. Following the investigation, Google terminated Discover-Tech’s access to its advertising exchange platforms, while IAB Europe removed the company from its approved vendor registry.
The report also documented action by other advertising companies, including Beeswax, Vungle (Liftoff) and Eskimi, which removed, paused or blocked access associated with Discover-Tech.
These steps demonstrate how advertising infrastructure can become a security risk when malicious actors exploit systems designed for commercial targeting. They also show why monitoring advertising vendors and auditing third-party code are important parts of digital security.
What Users and Organisations Can Do
Although the report does not confirm infections in Pakistan, users and organisations can take practical steps to reduce their exposure to online threats.
- Keep operating systems, browsers and applications updated.
- Use supported devices and enable automatic security updates wherever possible.
- Limit unnecessary app permissions and review privacy settings.
- Use reputable security software and investigate unusual device behaviour.
- Government agencies, businesses and media organisations should monitor network traffic and review third-party advertising and tracking scripts.
- Organisations handling sensitive information should seek qualified incident-response assistance if they discover suspicious network activity.
These measures cannot guarantee protection against sophisticated zero-click spyware, but they can strengthen general security and help organisations detect suspicious activity earlier.
Conclusion
Pakistan’s reported second-place ranking in spyware-linked advertising bids highlights the scale at which online advertising systems can be used for tracking and potentially malicious activity. The Citizen Lab investigation also documents how this infrastructure was linked to confirmed spyware attacks against Al Jazeera devices.
However, the Pakistan-specific evidence should be interpreted carefully. The reported advertising activity and government-network impressions do not prove that Pakistani users or officials were infected. Further investigation would be needed to establish whether any devices in Pakistan were successfully compromised.