On October 15, the University of Toronto research group Citizen Lab released a deeply concerning report. The researchers revealed a massive cybersecurity threat utilizing the online advertising ecosystem. An Israeli company named Discover-Tech actively helped hack devices through online advertisements. Furthermore, the report identified Pakistan as one of the most heavily targeted countries globally by these Israeli spyware ads.
Israeli Spyware Ads Massively Targeting Pakistan
Researchers analyzed nearly four billion bidding records from Discover-Tech’s ad system. They evaluated data spanning from March to June 2026. Consequently, they discovered that roughly 19% of these bids carried hidden scripts meant to deliver attack code.
Pakistan ranked second worldwide for these malicious bids. Discover-Tech targeted the country with approximately 139 million bids. Only Yemen ranked higher, facing about 457 million bids. Additionally, these dangerous ads appeared more than 100,000 times on the popular Pakistani website whatmobile.com.pk. The malicious campaign also successfully reached government-operated networks in Pakistan. However, the report did not name the specific government networks involved in the breach.
The Silent Threat of AdFection
Citizen Lab calls this invisible attack technique “AdFection”. Specifically, Discover-Tech sold ad space loaded with hidden attack code. A device could suffer a spyware infection simply by displaying the advertisement on the screen. The victim does not even need to click on the ad to trigger the exploit.
Discover-Tech essentially acted as a bridge between spyware creators and the online advertising system. Through these malicious ads, attackers delivered spyware created by Candiru, another Israeli firm now operating under the name Integrity Labs. Previously, attackers used this exact method to target at least 45 devices at the Al Jazeera news network during 2024 and 2025.
The Pindi Connection & Future Risks
The researchers also uncovered a suspicious user alias named “Pindi”. This user logged into Discover-Tech’s Controlium control platform exclusively from Pakistan. However, Citizen Lab could not conclusively link this user to any specific mercenary spyware company. A platform login merely shows usage originating from that location. It does not prove attackers actively targeted anyone specific there.
Moreover, an ad impression does not automatically guarantee a successful hack. The available data does not reveal if attackers actively chose specific individuals in Pakistan for infection. Still, researchers urge immediate investigations. The sheer scale of this targeted campaign poses a severe cybersecurity risk for anyone using the affected networks.
