Report Reveals Pakistan Among Top Targets of Israeli Spyware Ads

Researchers analyzed nearly four billion bidding records from Discover-Tech’s ad system. They evaluated data spanning from March to June 2026. Consequently, they discovered that roughly 19% of these bids carried hidden scripts meant to deliver attack code.

Pakistan ranked second worldwide for these malicious bids. Discover-Tech targeted the country with approximately 139 million bids. Only Yemen ranked higher, facing 457 million bids. Additionally, these dangerous ads appeared more than 100,000 times on the popular Pakistani website whatmobile.com.pk . The malicious campaign also successfully reached government-operated networks in Pakistan. However, the report did not name the specific government networks involved in the breach.

The Silent Threat of AdFection

Discover-Tech essentially acted as a bridge between spyware creators and the online advertising system. Through these malicious ads, attackers delivered spyware created by Candiru, another Israeli firm now operating under the name Integrity Labs. Previously, attackers used this exact method to target at least 45 devices at the Al Jazeera news network during 2024 and 2025.

The Pindi Connection & Future Risks

The researchers also uncovered a suspicious user alias named “Pindi”. This user logged into Discover-Tech’s Controlium control platform exclusively from Pakistan. However, Citizen Lab could not conclusively link this user to any specific mercenary spyware company. A platform login merely shows usage originating from that location. It does not prove attackers actively targeted anyone specific there.

Moreover, an ad impression does not automatically guarantee a successful hack. The available data does not reveal if attackers actively chose specific individuals in Pakistan for infection. Still, researchers urge immediate investigations. The sheer scale of this targeted campaign poses a severe cybersecurity risk for anyone using the affected networks.