Israeli Spyware Ads Widely Target Pakistan Online
A recent investigation by Citizen Lab at the University of Toronto has uncovered an alarming cybersecurity threat involving Israeli spyware ads aggressively aimed at Pakistan. This campaign exploits the online advertising ecosystem to stealthily infect devices through malicious advertisements.
Pakistani Users Among Top Victims of Spyware Ads
Between March and June 2026, researchers analyzed almost four billion ad bidding records from Discover-Tech, an Israeli advertising technology company. Their findings revealed that nearly one-fifth of these bids contained concealed scripts designed to deploy attack code. Out of all countries targeted globally, Pakistan was the second most affected, with approximately 139 million malicious bids directed at its users. Yemen ranked highest, enduring about 457 million such bids. Remarkably, these harmful ads appeared over 100,000 times on a well-known Pakistani site, whatmobile.com.pk, and also penetrated certain government network infrastructures within the country—though the report did not specify which ones.
How the Spyware Ads Work: The AdFection Technique
The mode of attack, termed “AdFection” by Citizen Lab, involves embedding spyware in online ads served by Discover-Tech. Users’ devices become compromised simply by loading the infected advertisement, with no user interaction required. Discover-Tech effectively acts as an intermediary connecting spyware developers to unsuspecting internet users via its ad platform. The spyware originates from Candiru, another Israeli company now operating as Integrity Labs, known for supplying advanced surveillance tools. Previously, this attack method targeted Al Jazeera, affecting at least 45 devices between 2024 and 2025.
Implications and the Need for Vigilance in Pakistan
The report also identified a suspicious user alias named “Pindi” accessing Discover-Tech’s control platform exclusively from Pakistan. Although the researchers could not definitively associate this activity with any particular spyware group, it indicates localized involvement in managing these campaigns. Not every ad impression translates to a successful infection, but given the scale of the targeting, Citizen Lab urges Pakistani authorities and cybersecurity stakeholders to investigate promptly to mitigate potential risks. These revelations highlight the heightened cyber threats Pakistan faces through an increasingly sophisticated exploitation of digital advertising networks.
According to Citizen Lab’s researchers, “The sheer scale of this targeted campaign poses a severe cybersecurity risk for anyone using the affected networks.” For Pakistan, where digital infrastructure is rapidly expanding, this exposure underscores the urgent necessity for robust cybersecurity measures to protect individuals, organizations, and government systems from covert spyware attacks delivered through everyday online channels.
