TORONTO – Pakistan ranked second globally in advertising bids linked to an Israeli spyware campaign that used online ads to target mobile devices, according to a report published on October 15 by Citizen Lab, a research group at the University of Toronto.
The report, titled “Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware”, recorded approximately 139 million advertising bids linked to the campaign in Pakistan between March and June 2026. Only Yemen, with around 457 million bids, recorded a higher number.
However, the figures do not establish that Pakistani users were infected with spyware. Citizen Lab only documented advertising activity associated with a potential attack mechanism and reported no confirmed infections in Pakistan.
How were Pakistani users exposed?
The scale of the reported activity becomes clearer when the term ‘advertising bid’ is understood. When a user opens an app or website, an advertising slot can be sold through a real-time auction that takes place in a fraction of a second, where companies submit bids to display advertisements to users who match their targeting criteria.
Citizen Lab examined nearly four billion advertising bidding records associated with Discover-Tech, an Israeli advertising technology company. Of the approximately 3.77 billion bids placed by the company during the period studied, it appeared to win around 11.7 per cent. The 139 million bids recorded in Pakistan therefore represent attempts to purchase advertising space, not 139 million advertisements confirmed to have appeared on users’ screens.
Citizen Lab did, however, document the advertisements appearing more than 100,000 times on Pakistani technology website WhatMobile. Pakistan was also among the countries where the advertisements appeared on government-operated networks. However, Citizen Lab did not identify the specific government networks involved.
How can an advertisement deliver spyware without a click?
The campaign, which Citizen Lab calls AdFection, exploits the infrastructure behind online advertising to deliver potentially malicious code to selected devices. The advertisements contain a hidden script that communicates with a server operated by Discover-Tech. The server assesses whether a device meets the campaign’s targeting criteria. For most users, the process reportedly returns no malicious payload, but for selected devices, the server can deliver code designed to exploit a security vulnerability and install spyware.
A targeted device can be exposed simply by displaying the advertisement, without the user clicking on it. Such attacks are known as zero-click attacks because they do not require the victim to interact with the malicious content. The distinction is significant because users may have little indication that an advertisement is doing anything beyond displaying ordinary content.
The report also points to previous cases involving commercial spyware. Citizen Lab found that at least 45 devices at the Al Jazeera news network were infected in 2024 and 2025 with spyware associated with Candiru, a company now rebranded as Integrity Labs. The US Commerce Department added Candiru to its restricted list in 2021.
Does Pakistan’s ranking mean its phones are more vulnerable?
The ranking is based on the total number of advertising bids recorded in each country, rather than the proportion of its population targeted or the number of devices successfully compromised.
Pakistan’s position in the overall ranking may partly reflect the size of its digital audience. Parliamentary Secretary for Information Technology and Telecommunication Sabheen Ghoury told the National Assembly, on October 23, that the country had approximately 210 million mobile subscriptions, including 161.7 million mobile broadband subscriptions. The Economic Survey also reported that smartphones accounted for 71.6 per cent of devices.
The report found that approximately 77 per cent of Discover-Tech’s bids focused on mobile apps, meaning countries with large mobile audiences could offer substantial advertising inventory. While Yemen and Pakistan had a higher overall volume of raw bids, roughly 83 per cent, due to their larger populations, Palestine saw the highest concentration of malicious ad infrastructure relative to its total internet traffic.
Who faces the greatest risk?
The findings do not suggest that every Pakistani internet user faces the same level of risk.
Pakistan’s National Cyber Emergency Response Team (PKCERT) said that seeing an advertisement does not mean a device has been compromised because a successful attack would also require the exploitation of a security vulnerability. PKCERT identified journalists, government officials, researchers and corporate executives as groups of particular concern because sophisticated spyware campaigns can be designed to target specific individuals.
Citizen Lab also identified an account on Discover-Tech’s platform using the name “Pindi”, which had logged in only from Pakistan. However, researchers could not establish a link between the account and a spyware company. An account’s login location, by itself, does not establish who was targeted or whether an attack occurred. The report therefore leaves open the possibility of targeted exposure in Pakistan without confirming successful infections.
How did the advertising industry respond?
The investigation also raised questions about how an advertising company linked to a spyware delivery system was able to operate through established advertising infrastructure.
According to Citizen Lab, Discover-Tech had appeared on Google’s certified vendor lists since 2020 and on a list maintained by IAB Europe until October 2026. Following Citizen Lab’s disclosure, Google, IAB Europe, Beeswax, Vungle, which is part of Liftoff, and Eskimi cut off the company’s access to their services.
What can users in Pakistan do to protect their phones?
PKCERT recommends keeping mobile operating systems, browsers and applications updated to ensure known security vulnerabilities are patched. Users should also install applications only from trusted sources, choose devices that continue to receive security updates, and use strong, unique passwords alongside multifactor authentication.
Citizen Lab recommends using a trusted ad-blocking extension where supported, as well as network-level advertising restrictions, such as blocking tools configured on a home router. However, PKCERT cautions that ad blockers cannot guarantee protection against spyware. Users can also reset their advertising IDs and disable personalised advertising where their device and operating system allow it.
An unusually hot phone, rapid battery drain or sluggish performance should not automatically be interpreted as evidence of spyware. Similarly, a clean antivirus scan cannot conclusively establish that a device is safe. Anyone who suspects a sophisticated compromise should seek specialist cybersecurity assistance before resetting the device, as a factory reset could destroy evidence needed to investigate an attack.
For government departments and other organisations handling sensitive information, Citizen Lab recommends implementing ad-blocking measures across government-owned devices and disabling advertising IDs on government phones. PKCERT also advises organisations to maintain device inventories and preserve DNS, firewall and proxy logs to support investigations.
What remains unknown?
In Pakistan, the available findings leave two important questions unanswered: which government-operated networks displayed the advertisements, and whether devices connected to those networks have been examined for signs of compromise. Until those questions are addressed, the reported figures should be understood as evidence of substantial exposure to advertising activity associated with a spyware delivery mechanism, not as proof of a nationwide hacking incident.
