Key Takeaways
- Pakistan recorded the second-highest number of advertising bids linked to an Israeli spyware operation.
- Around 139 million ad bids involved malicious code capable of infecting devices.
- Al Jazeera devices were among at least 45 targeted through this method.
Pakistan has emerged as a significant target in an Israeli spyware campaign, according to a recent report by Citizen Lab, a research group at the University of Toronto. The investigation revealed that Pakistan recorded the second-highest number of advertising bids linked to the operation, with approximately 139 million bids.
Citizen Lab examined nearly four billion advertising bidding records from Discover-Tech’s system between March and June 2026. The report found that about 19% of the bids involved advertisements containing scripts capable of delivering attack code to selected devices.
The advertisements appeared more than 100,000 times on Pakistani technology website WhatMobile.com.pk, and the researchers noted that Pakistan was among the countries where these advertisements appeared on government-operated networks. However, the report did not specify which networks were involved.
Al Jazeera devices were targeted through this method, with at least 45 devices identified as being affected during 2024 and 2025. Citizen Lab attributed the attacks to Candiru, an Israeli company now known as Integrity Labs, with high confidence.
The investigation also identified a user named ‘Pindi’ who accessed Discover-Tech’s control platform exclusively from Pakistan. However, Citizen Lab could not establish a direct connection between the account and any spyware company.
Researchers warned that displaying a suspicious advertisement does not automatically mean a device was hacked. The bidding records do not identify individuals in Pakistan who may have been selected for surveillance. However, the large number of suspicious advertisements highlights potential security risks.
The report also highlighted that the wider online advertising system could allow spyware companies to identify and monitor users without their knowledge. Following the investigation, Google removed Discover-Tech from its advertising platforms, while IAB Europe removed the company from its approved vendor list.
Other advertising companies also restricted its access, underscoring the need for stronger measures in the online advertising industry to prevent such security breaches.
