Pakistan was among the countries most heavily targeted through spyware delivery attempts linked to online advertisements operated through an Israeli company, according to a report by Citizen Lab, a research group at the University of Toronto. The report examined how malicious advertising infrastructure was allegedly used to deliver spyware through online ad systems, revealing a technique that could compromise devices without requiring users to click on a link or download a file.
Published on October 15, the report identified an Israeli firm called Discover-Tech as a company that sold advertising space carrying hidden attack code. Citizen Lab named the technique “AdFection” and explained that the method relies on malicious code being delivered through advertisements displayed on websites. Unlike traditional phishing methods that require user interaction, the reported technique could potentially expose devices simply when an advertisement is displayed. Citizen Lab said this type of activity highlights concerns around security risks within the digital advertising ecosystem. According to the research, Discover-Tech allegedly operated as a connection point between spyware developers and online advertising networks. The report stated that spyware associated with another Israeli firm, Candiru, which has since been renamed Integrity Labs, was delivered through these advertisements. Citizen Lab linked the activity to Candiru with high confidence and reported that at least 45 devices belonging to Al Jazeera were targeted through this method during 2024 and 2025. The findings were based on an analysis of advertising data and related technical indicators.
Researchers reviewed nearly four billion bidding records from Discover-Tech’s advertising system covering the period from March to June 2026. The analysis found that around 19 percent of the bids involved advertisements containing scripts capable of delivering attack code to selected devices. Pakistan ranked second globally among countries associated with these bids, with approximately 139 million records, while Yemen recorded around 457 million. Citizen Lab also reported that the same advertisements appeared more than 100,000 times on a Pakistani website, whatmobile.com.pk. The report further listed Pakistan among countries where similar advertisements appeared on government-operated networks, although it did not identify the specific networks involved. The research also identified a user account named “Pindi” that accessed Discover-Tech’s control platform exclusively from Pakistan. However, Citizen Lab clarified that it could not conclusively connect this user to any spyware organisation. The researchers also identified two other unattributed users accessing the platform from India and Italy. Citizen Lab noted that a login from a particular country only indicates platform access from that location and does not confirm that individuals or organisations in those countries were targeted.
Citizen Lab emphasized that the appearance of a malicious advertisement does not automatically confirm that a device was compromised. The report stated that an advertisement impression alone does not prove targeting or infection, and the available data does not reveal whether any specific Pakistani users were selected as victims. However, researchers highlighted the scale of the activity as a significant security concern and recommended further investigation to determine whether devices connected to affected networks were compromised. The report also found that similar advertisements reached networks connected with organisations including NATO, the United Nations, and the European Parliament, along with government ministries in multiple countries. Citizen Lab said the issue reflects broader challenges within online advertising systems, where complex supply chains and automated ad delivery processes can create opportunities for abuse. The findings underline the need for stronger security monitoring across digital advertising platforms and greater awareness of emerging spyware delivery methods.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
