Pakistan registered the second-highest volume of advertising bids connected to an Israeli spyware distribution scheme, based on an October 15 study published by Citizen Lab, a research organization at the University of Toronto.

The study revealed that an Israeli entity named Discover-Tech leveraged digital ads to transmit harmful software capable of compromising devices without user interaction.

This method was labeled "AdFection" by Citizen Lab, which connected the campaign to spyware created by another Israeli firm, Candiru, currently operating as Integrity Labs.

Pakistan Records 139 Million Ad Bids

Between March and June 2026, Citizen Lab analyzed roughly four billion ad bidding logs from the system of Discover-Tech.

Investigators discovered that about 19% of those bids featured ads embedded with scripts that could transmit attack code to targeted devices.

Pakistan placed second worldwide with approximately 139 million such bids, trailing Yemen, which logged about 457 million.

The study also showed that the ads surfaced over 100,000 times on the Pakistani tech portal WhatMobile.com.pk.

Pakistan was likewise situated among nations where these ads displayed on state-run networks, though the study omitted the names of the specific Pakistani networks involved.

Al Jazeera Devices Targeted

Citizen Lab stated that Discover-Tech functioned as a bridge between spyware creators and digital advertising networks.

The firm reportedly used ad architecture to spread spyware engineered by Candiru.

Investigators determined that a minimum of 45 devices belonging to Al Jazeera suffered targeting via this approach throughout 2024 and 2025.

Citizen Lab linked the assaults to Candiru with high confidence.

Pakistani User Identified

The inquiry likewise pinpointed a user designated "Pindi" who logged into the control platform of Discover-Tech exclusively from Pakistan.

Nonetheless, Citizen Lab failed to confirm whether the profile linked to any spyware enterprise.

Investigators additionally spotted two separate unidentified users who logged into the platform originating from India and Italy.

The document specified that login spots merely show the physical location from which users accessed the platform and fail to confirm if people residing in those nations faced targeting.

Ad Exposure Does Not Confirm Infection

Citizen Lab noted that showing a questionable ad fails to prove a device suffered a compromise.

Investigators explained that an ad impression by itself cannot determine whether an individual faced targeted monitoring or spyware infection.

In a similar fashion, the bidding logs fail to pinpoint specific people inside Pakistan chosen for surveillance.

Despite this, investigators cautioned that the high volume of questionable ads points to serious security vulnerabilities and urged probes to check if devices on impacted networks experienced breaches.

Global Networks Also Exposed

The study revealed that ads from Discover-Tech additionally reached networks linked to NATO, the United Nations, the European Parliament, and state ministries across multiple countries.

Citizen Lab cautioned that the broader digital advertising ecosystem could permit spyware firms to pinpoint and track users in secret.

In the wake of the inquiry, Google banned Discover-Tech from its ad networks, while IAB Europe dropped the business from its approved vendor roster. Additional ad firms likewise curtailed its access.

Investigators emphasized that the discoveries expose flaws within the digital advertising sector and underline requirements for robust protections against spyware assaults.