ISLAMABAD: Pakistan was one of the most heavily targeted countries in a global spyware campaign that hid attack code inside ordinary online advertisements, according to a new report by Citizen Lab, the cybersecurity research group at the University of Toronto.
The report, published on October 15, reveals that an Israeli firm called Discover-Tech sold advertising space that carried hidden attack code. Citizen Lab calls the technique “AdFection” — and its key finding is that a device could be infected with spyware simply by displaying an advert, without anyone clicking on it.
How “AdFection” Works
Discover-Tech acted as a bridge between spyware makers and the online advertising system, according to the report. Spyware from another Israeli firm, Candiru — now renamed Integrity Labs — was delivered through these adverts.
The researchers say at least 45 devices belonging to the Qatari news network Al Jazeera were targeted this way during 2024 and 2025. The report links those attacks to Candiru with high confidence.
The study is based on an enormous dataset: nearly four billion bidding records from Discover-Tech’s advertising system, covering March to June 2026. About 19 percent of those bids were for adverts carrying a script capable of delivering attack code to a chosen device.
Pakistan Second Only to Yemen
Pakistan ranked second in the world for these bids, with about 139 million. Only Yemen, with about 457 million, was ahead of Pakistan.
The same adverts appeared more than 100,000 times on a Pakistani website, whatmobile.com.pk, the report notes. It also lists Pakistan among the countries where the ads appeared on government-operated networks — though it does not name the Pakistani networks involved.
The report further mentions that a user named “Pindi” logged into Discover-Tech’s control platform exclusively from Pakistan. The researchers caution that they could not conclusively link the user to any spyware company. Two other unattributed users logged in from India and Italy, they added, and a login from a country does not prove anyone there was targeted.
Ad Impression Does Not Mean Infection
Citizen Lab stresses that seeing an advert does not mean a device was hacked. The report says an ad impression “does not in and of itself confirm targeting or infection”, and the data does not show who in Pakistan — if anyone — was chosen as a target.
Still, the researchers say the sheer scale of the bidding activity points to a serious risk and urge investigations into whether anyone on the affected networks was actually infected.
A Structural Problem With Online Ads
The adverts were not limited to Pakistan. Citizen Lab says they also reached networks linked to NATO, the United Nations and the European Parliament, along with government ministries in many countries.
According to the researchers, the problem is built into how online advertising works: the real-time bidding systems that serve ads can be exploited to quietly deliver malicious code to targeted devices.
For users in Pakistan, the report is a reminder that everyday browsing can carry hidden risks — and that even a simple banner advert, never clicked, could in theory be used as an infection vector.
Who Is Citizen Lab?
Citizen Lab is an interdisciplinary research laboratory based at the University of Toronto. It is widely known for investigating spyware and digital threats against civil society, journalists and governments around the world.
The group has previously exposed surveillance campaigns across the Middle East, South Asia and beyond. Its findings have frequently led to sanctions, lawsuits and public debate about the commercial spyware industry.
This latest report, released on October 15, 2026, is one of the most detailed studies yet of how the online advertising ecosystem can be repurposed as a delivery system for state-grade spyware.
What This Means for Users in Pakistan
The report does not claim that any specific person in Pakistan was infected. But the numbers are hard to ignore: 139 million ad bids directed at the country, and more than 100,000 impressions on a single popular Pakistani website.
Cybersecurity experts generally advise keeping browsers and operating systems up to date, since attack code usually relies on software vulnerabilities that are later patched. Using reputable ad-blocking tools can also reduce exposure to potentially malicious adverts.
For journalists, activists and public officials — the typical targets of commercial spyware — the findings are especially relevant. Citizen Lab’s researchers say governments and regulators should investigate whether anyone on the affected networks was infected, and whether the platforms involved did enough to stop it.
Sources: The News / AFP; Citizen Lab, University of Toronto, report published October 15, 2026.
Related Posts
TechnologyOneOffice and ZIEL Global Bring Affordable Cloud Office Suite to Pakistan
TechnologyPoco X8S Launches Globally: Compact 6.35-Inch Phone With Snapdragon 7 Gen 4, 100W Charging From $399
TechnologyEcoStar Launches 100-Inch QD Mini LED TV in Pakistan — Biggest Screen, Cinema-Scale 4K
TechnologyWorld Bank Proposes $50 Million Fund of Funds for Pakistan’s Startups
TechnologyEndeavor Pakistan Hosts Google’s Hashim Syed for AI Founders Series Session
ShowbizGhost School Releases in Pakistani Cinemas Today After Sindh Censor BattleMost Popular
How-ToPTA Tax Calculator 2026: Check Mobile Tax on Any Phone336 views
SportsUEFA Champions League 2026-27: Format, Teams and Schedule322 views
SportsBallon d’Or 2026: London Ceremony, Nominees and All-Time Records Ahead of 70th Anniversary321 views
Canada JobsTech Jobs in Canada: Roles, Salaries, and Skills Needed311 views
Pakistan NewsPIA Boeing 787 Lease Deal: What It Means for the Airline297 views
ShowbizWomen’s Fashion in Pakistan 2026: Trends, Brands and Style Guide297 views
One comment