Pakistan ranked second worldwide in the number of bids for advertisements linked to a potential spyware-delivery system, according to an investigation by the University of Toronto's Citizen Lab. The research raises serious questions about digital privacy and online advertising, but it does not establish that Pakistani users were successfully infected with spyware.
The investigation, published on October 15, 2026, examined advertising records from March through June 2026. Researchers identified exactly 139,427,322 bids associated with IP addresses geolocated to Pakistan for advertisements apparently containing scripts linked to surveillance infrastructure.
Yemen topped the ranking with 457,283,658 bids, while Montenegro placed third with 97,595,716. Pakistan's position was based on the total number of recorded bids, not the number of people hacked or devices infected.
The study, titled Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware, links an Israel-based advertising technology company to a system used for device tracking and the selective delivery of commercial spyware.
Citizen Lab separately confirmed spyware infections involving devices at international news organisation Al Jazeera. However, those attacks occurred in 2024 and 2025 and are distinct from the 2026 advertising data used to rank Pakistan.
The findings therefore raise an important question for Pakistani internet users: how can an ordinary online advertisement become a route for surveillance, and what does the available evidence actually prove?
Why did Pakistan rank second in the Citizen Lab investigation?
Citizen Lab examined records from MyDSP, an advertising platform associated with Discover-Tech. The platform participated in automated auctions for advertising space on websites and mobile applications.
Researchers reviewed 3,770,286,576 bids submitted during the four-month period. Within that dataset, they identified at least 718,748,885 bids for advertisements that apparently contained scripts pointing to infrastructure associated with Discover-Tech's surveillance operations.
The researchers identified these potentially relevant advertisements through technical indicators and names recorded in the bidding database. This classification did not establish that every associated advertisement delivered malicious software.
According to Table 4 of the original report, Yemen recorded 457,283,658 relevant bids, followed by Pakistan with 139,427,322, Montenegro with 97,595,716, Brazil with 76,108,495 and Mexico with 32,675,229.
The bids involved IP addresses geolocated to 161 countries. Pakistan ranked second by raw volume within this particular dataset.
The researchers also compared countries according to bids per resident. In that separate ranking, Montenegro came first, followed by Yemen and Armenia. Pakistan was not among the top ten countries.
That difference matters. A high number of total bids does not mean that an individual in Pakistan faced the world's second-highest likelihood of encountering the advertisements or suffering a spyware infection.
The rankings measure observed advertising activity, not the prevalence of successful hacking.
Does the 139.4 million figure represent Pakistani users or hacked phones?
No. The figure represents advertising bids. It does not identify 139.4 million separate people, devices or successful cyberattacks.
When a user opens a website or mobile app containing an advertising space, an automated system may invite advertisers to compete for the opportunity to display an advertisement.
Each offer submitted by an advertiser is called a bid. The advertiser can lose the auction, meaning its advertisement may never appear on the user's screen.
If an advertiser wins and its advertisement is displayed, that produces an impression. One person may generate many advertising auctions and impressions by repeatedly opening websites or apps.
Advertising systems can also collect information such as device identifiers and network details. However, collecting tracking data is not the same as launching a targeted software exploit.
Even an attempted exploit does not necessarily succeed. Confirming a spyware infection requires reliable technical evidence that the device was compromised.
Citizen Lab's Pakistan figures do not supply that evidence. The researchers did not establish the number of unique Pakistani users represented by the bids, how many were individually selected for an attack or how many devices, if any, were successfully infected.
The most accurate conclusion is that a large volume of advertising activity associated with potentially dangerous infrastructure was recorded against Pakistani IP geolocations.
How reliable is the location data behind Pakistan's ranking?
The advertising database contained IP addresses or partial IP-address ranges and city-level location information that could be used to associate bidding activity with countries.
However, Citizen Lab reported that the data did not contain mobile advertising IDs, cookie identifiers or GPS coordinates that would allow researchers to establish the number or precise location of unique individuals.
IP geolocation also has limitations. A person using a VPN may appear to access the internet from another country, while satellite networks, servers and other internet arrangements can produce misleading location information.
The researchers specifically cautioned against treating every recorded country assignment as an exact physical location.
These limitations do not erase the 139,427,322 bids in the Pakistan category. They mean that the number should be reported for what it is: activity assigned to Pakistan through the dataset's location records.
It should not be converted into an estimate of the country's actual spyware victims or presented as a direct measurement of individual surveillance risk.
How could an ordinary online advertisement deliver spyware?
Many internet advertisements contain more than a static image. They can include software scripts used to load content, measure views or communicate with outside advertising services.
Citizen Lab found that Discover-Tech used this feature to connect devices displaying its advertisements with servers under its control.
The researchers identified a system described as a NOAS server that could receive device-related information and decide whether to return additional code.
For most advertising recipients, the server might return no further executable content. But for a device selected by a surveillance operator, it could return code designed to exploit a vulnerability.
Citizen Lab named this advertising-based attack technique AdFection.
The term zero-click refers to an exploit that does not require the person being targeted to tap a link, open an attachment or deliberately interact with the malicious advertisement.
The advertising content itself may initiate the necessary technical contact when an application or browser renders it.
This makes the method especially concerning because it can use an ordinary online activity, such as reading an article or opening an app, as an opportunity for surveillance.
But the distinction between exposure and infection remains essential. A relevant advertisement appearing on a screen does not automatically mean malicious code was delivered or that a spyware attack succeeded.
The Citizen Lab executive summary describes how the same infrastructure could support broad profiling of users and much narrower attacks against specially selected devices.
What did Citizen Lab find on Pakistan's WhatMobile website?
Citizen Lab identified more than 100,000 impressions of advertisements containing the relevant scripts on whatmobile.com.pk, a Pakistani website that provides mobile-phone information and prices.
Unlike bids, impressions refer to advertisements that were actually shown through the website or application being examined.
The finding shows that the advertising infrastructure under investigation reached a familiar Pakistani consumer website.
However, the report does not establish that WhatMobile's owners, editors or employees knowingly participated in surveillance, approved the suspicious code or deliberately helped distribute spyware.
Web publishers frequently obtain advertisements from third-party networks. Those networks conduct automated auctions and deliver advertising material supplied through multiple intermediaries.
A website may therefore display an advertisement without directly controlling every technical component contained within it.
Similarly, the impression count cannot be converted into the number of individual website visitors, selected targets or infected phones.
Repeated impressions are possible, and Citizen Lab explicitly warns that a displayed advertisement alone is not proof of a successful infection.
The WhatMobile finding is evidence of how far the suspicious advertising infrastructure reached, not an established allegation of wrongdoing against the publisher.
Did the suspicious advertisements reach Pakistani government networks?
The report also includes Pakistan among the countries where Discover-Tech advertisements appeared on government-operated networks.
Citizen Lab examined impressions on networks connected to public institutions, national-security organisations, international bodies and other sensitive environments around the world.
The Pakistan entry appears in the researchers' country-level list. The report does not identify specific Pakistani ministries, intelligence organisations, military units or other government institutions in that entry.
It also does not establish that a named Pakistani government device or network was successfully compromised.
An advertisement appearing on a device connected to a government-operated network is not equivalent to an attacker breaking into that network.
The same investigation recorded impressions on networks associated with NATO, the United Nations and several European institutions.
These findings demonstrate that potentially dangerous advertising infrastructure could reach sensitive environments, even if the records alone cannot determine whether individual devices were selected for exploitation.
Citizen Lab called for further investigation to establish whether any users on such networks were actually infected.
For Pakistan, the evidence supports reporting the presence of relevant advertisements on government-operated networks, without naming unidentified agencies or claiming confirmed government-system hacks.
What is known about the account named Pindi?
Another Pakistan-related detail emerged from Citizen Lab's examination of Controlium, a platform operated by Discover-Tech and linked by researchers to surveillance-related advertising activities.
The investigators examined authentication records and found a user account named Pindi.
According to the report, the account's observed logins came exclusively from IP addresses geolocated to Pakistan.
Citizen Lab grouped Pindi with accounts whose real-world owners or organisational connections could not be conclusively established.
Other unidentified users in that section had logins primarily associated with India or exclusively associated with Italy.
The name Pindi does not establish a connection with Rawalpindi, a Pakistani government agency or any intelligence organisation.
The report provides no confirmed identity, nationality, employer or operational purpose for the person using the account.
It would therefore be misleading to interpret the account as evidence of a particular Pakistani institution operating the spyware system.
The finding establishes an observed technical connection to Pakistan through login-location data, while leaving the account holder's identity unresolved.
What happened in the spyware attacks on Al Jazeera?
The clearest evidence that this technique was used to infect devices comes from Citizen Lab's investigation into attacks involving international news network Al Jazeera.
During 2024 and 2025, at least 45 devices within the organisation were targeted in operations that Citizen Lab linked with high confidence to spyware developed by Candiru.
Researchers analysed network records supplied by Al Jazeera and identified a sequence of communications involving Discover-Tech's advertising infrastructure and servers associated with Candiru.
On infected devices, the records showed contacts consistent with an advertisement being rendered, subsequent communication with a Candiru validation server and further activity associated with the spyware operation.
The researchers also examined additional technical evidence from compromised systems, supporting the conclusion that spyware infections had occurred through this advertising-based mechanism.
This made AdFection a documented real-world attack method, rather than merely a theoretical vulnerability.
However, the figure of at least 45 refers to targeted devices. It should not automatically be rewritten to mean that forensic evidence established a successful infection on every one of those devices.
Al Jazeera condemned the attacks on its staff. The Committee to Protect Journalists also highlighted the threat to journalists, their confidential sources and newsroom communications.
The attacks on Al Jazeera occurred in 2024 and 2025. The Pakistan ranking concerns advertising bids collected in 2026. The two findings must remain separate.
The Al Jazeera case confirms that the technique could lead to successful spyware infections, but it does not establish that the same outcome occurred in Pakistan.
Who are Discover-Tech and Candiru?
Citizen Lab identifies Discover-Tech as an Israel-based advertising technology company whose systems connected online advertising networks with commercial surveillance providers.
The researchers describe its MyDSP platform as a way to purchase advertising placements and its Controlium platform as a system that supported the identification, profiling and targeting of devices.
The investigation alleges that Discover-Tech's advertising infrastructure could be used to provide selected devices with code intended for surveillance attacks.
Candiru is a separate commercial spyware developer. Citizen Lab links its software to the confirmed Al Jazeera infections and refers to its association with the name Integrity Labs.
The two companies therefore performed different roles in the documented operation. Discover-Tech supplied access to advertising and targeting infrastructure, while Candiru supplied spyware linked to the Al Jazeera attacks.
The US Department of Commerce added Candiru to its Entity List in 2021 amid concerns about the use of its spyware against individuals including journalists, government officials and civil-society figures.
Citizen Lab also documented connections involving other surveillance-related companies, including Intelos and Bindecy.
These connections do not establish the identity of every customer, the purpose of every advertising campaign or the involvement of any particular Pakistani institution.
An independent investigation by advertising-security company Confiant also identified suspicious Discover-Tech advertising code and connections to surveillance infrastructure.
How widespread was the advertising activity?
Citizen Lab's investigation covered 3,770,286,576 advertising bids placed through Discover-Tech's MyDSP platform during March–June 2026.
The system appeared to win 441,954,291 auctions, equivalent to approximately 11.7% of its bids.
Researchers identified at least 718,748,885 bids associated with advertisements that appeared to contain the specific scripts linked to the infrastructure under investigation.
These figures describe different measurements. The total bids cover MyDSP's recorded bidding activity, while the smaller category concerns advertisements identified through particular technical indicators.
Citizen Lab also found that relevant advertisements were actually displayed through 75,373 different Android and iOS apps and 120,768 websites.
The services included games, media websites, weather applications, entertainment platforms and other widely used digital products.
These totals count different apps and websites, not compromised applications, malicious publishers or infected users.
Nor did the records cover every advertising channel used by Discover-Tech. The researchers lacked equivalent bidding data for certain other platforms, including Beeswax and Eskimi.
The available records therefore reveal a large and significant portion of the observed activity without representing an exhaustive count of every possible bid, target or infection worldwide.
How did Google and other advertising companies respond?
The investigation prompted action by several advertising platforms and industry organisations.
Google told Citizen Lab that it terminated Discover-Tech's access to its advertising exchanges, preventing the company from bidding for or serving advertisements through those platforms.
Google also said it had deployed Safe Browsing protections intended to warn users who might encounter known domains associated with the identified actor.
IAB Europe said in its October 15, 2026 statement that Discover-Tech was suspended from the Global Vendor List following an audit that identified violations of its Transparency and Consent Framework policies.
The organisation said the suspension would continue until the violations were remedied and compliance verified. It added that further confirmation of the findings could justify permanent expulsion.
The correct status in that statement was suspension, not a confirmed permanent expulsion.
Beeswax, associated with Comcast's FreeWheel advertising business, said it removed Discover-Tech from its Buyer Cloud platform after security checks and independent verification.
Vungle, operated by Liftoff, said it paused Discover-Tech's access while conducting a review. Its response did not claim that the investigation had been completed.
Eskimi said its monitoring had identified advertising code that behaved differently depending on the user, device and network, making automated security checks difficult.
The company reported that it permanently blocked the relevant accounts, users and domains. It said Discover-Tech's last campaign on its platform stopped on August 6, 2026.
Citizen Lab also published responses from two businesses mentioned in its research. Adtimizer said it did not operate or control the Discover-Tech infrastructure identified by the researchers and denied knowledge of or involvement in the alleged malicious activity.
Volasim said it had used Discover-Tech as an external advertising provider to promote its products but denied commissioning, authorising, participating in or knowingly facilitating spyware-related activities.
Citizen Lab stated that Discover-Tech and Candiru had not responded to its requests for comment within the deadline provided before publication. Reuters independently reported on the allegations, company responses and advertising-industry action.
The companies' responses should not be treated as interchangeable. Some terminated access, some suspended access pending further action, while businesses linked to the investigation disputed any knowing involvement.
How can Pakistani users reduce spyware and advertising-tracking risks?
The research does not establish that every Pakistani internet user faces an immediate spyware threat. It does show that digital advertising infrastructure can be exploited for extensive tracking and carefully targeted attacks.
Citizen Lab recommends trusted ad-blocking tools and privacy-focused browsers that reduce advertising tracking and unnecessary external scripts.
Users can review mobile advertising settings and, where supported, reset or disable advertising identifiers used to recognise devices across different applications.
Keeping phones, browsers, operating systems and apps updated is also important because security updates can close vulnerabilities that attackers may exploit.
Installing applications from trustworthy sources and limiting unnecessary permissions can reduce other common risks, although these measures do not specifically guarantee protection against zero-click attacks.
Unlike ordinary phishing, zero-click exploitation may not require the victim to open a suspicious link. Caution about links is useful, but cannot by itself stop every sophisticated spyware technique.
People who face elevated risks because of their work, including journalists, activists and people handling sensitive information, should consider specialist digital-security advice and enhanced device protections.
Organisations can also reduce exposure by limiting targeted advertising and tracking on managed devices, applying network-level protections and reviewing suspicious connections.
Citizen Lab's recommendations and executive summary emphasise stronger oversight of the advertising ecosystem alongside individual precautions.
No combination of general security settings can guarantee protection from every advanced spyware attack.
What does the investigation mean for Pakistan's digital privacy?
Citizen Lab's findings expose a serious weakness in the modern advertising ecosystem: systems designed to identify consumers and deliver advertisements can also be abused to identify surveillance targets and distribute malicious code.
Pakistan's second-place position in the recorded bid ranking is significant, especially alongside evidence that relevant advertisements appeared on a Pakistani consumer website and on government-operated networks.
However, the limits of that evidence are equally important. The study does not establish that 139 million Pakistani people were hacked, that WhatMobile knowingly participated in surveillance, that a particular Pakistani government institution was compromised or that the account called Pindi belonged to an identifiable organisation.
The confirmed attacks on Al Jazeera establish that advertising-based zero-click spyware infections are possible and have occurred. Pakistan's 2026 data demonstrates extensive associated advertising activity, not confirmed infections.
Further forensic investigation would be required to determine whether anyone in Pakistan was specifically selected for an attack through this system and whether any attempt succeeded.
Until such evidence becomes available, the most accurate conclusion is that Pakistan ranked second in Citizen Lab's observed spyware-linked advertising bids, while the number of Pakistani devices actually infected remains unknown.
