An Israeli company placed about 139 million online ad bids aimed at Pakistan between March and June 2026, using ads that carried a hidden link to spyware servers. Only Yemen received more, according to a report published on October 15, 2026 by Citizen Lab, a research group at the University of Toronto.
The company, Discover-Tech, worked with Israeli spyware maker Candiru, the report says. Pakistan’s 139 million bids make up nearly one in every five of the roughly 719 million risky bids Citizen Lab counted worldwide, about 19%.
How an ad can carry spyware
When you open an app or a website, advertisers compete in a split-second auction to show you an ad. Each offer in that auction is called a bid.
Citizen Lab says Discover-Tech used this system as a cover. Its ads looked normal, often a plain “SALE” banner. But many carried a small piece of hidden code that quietly contacted Discover-Tech’s servers and sent back details about the device.
For most people, nothing else happened. The server sent back no further code. But if a device had been picked as a target, the server could send code that broke into it without the user clicking anything. Citizen Lab calls this method “AdFection.”
Candiru, now known as Integrity Labs, was blacklisted by the United States in 2021 for making spyware used against government officials, journalists and activists. Its spyware can take over a device, steal data, and switch on its microphone and camera, CyberScoop reported.
Citizen Lab says it confirmed, with high confidence, that at least 45 devices at the news network Al Jazeera were attacked this way in 2024 and 2025.
Ads reached a Pakistani website and government networks
The bid counts are based on where the internet connection appeared to be. Citizen Lab warns this can be wrong, for example when people use VPNs.
The researchers found more than 100,000 of these ads were actually shown on WhatMobile, a popular Pakistani phone-price website. They also found the ads reached networks run by Pakistan’s government, though the report does not name which ones.
One account on Discover-Tech’s control panel, using the name “Pindi,” logged in only from Pakistan. Citizen Lab said it could not link this account to any specific company.
Worldwide, the ads appeared in more than 75,000 apps and 120,000 websites. They included well-known apps such as Truecaller, Viber, MX Player, Opera Mini, Duolingo and the game Ludo STAR.
Seeing an ad does not mean you were hacked
Citizen Lab is clear that a Discover-Tech ad showing on a phone does not by itself prove the phone was targeted or infected. At the least, it says, the ad would have collected details about the device.
The researchers have asked for urgent checks on whether any users on the affected networks were hacked. They have also called on regulators to investigate Discover-Tech and Candiru.
After Citizen Lab shared its findings, Google cut Discover-Tech off from its ad systems, and the advertising group IAB Europe removed it from its approved list. Beeswax, Vungle and Eskimi also blocked the company. Citizen Lab senior researcher Wolfie Christl told CyberScoop it was “disastrous” that ad companies had not spotted the operation for years.
