Pakistan was one of the most heavily targeted countries by an Israeli company that helped hack Al Jazeera devices through online adverts, according to Citizen Lab, a research group at the University of Toronto. The October 15 report revealed an Israeli firm called Discover-Tech sold ad space that carried hidden attack code.
Citizen Lab calls the technique "AdFection". Its key finding is that a device could be infected with spyware just by displaying an advert, with no click needed.
Discover-Tech acted as a bridge between spyware makers and the online advertising system, according to the report. Spyware from another Israeli firm, Candiru - now renamed Integrity Labs - was delivered through these ads.
In 2024 and 2025, at least 45 devices at Al Jazeera were targeted this way, the report says. It links the attack to Candiru with high confidence.
The researchers studied nearly four billion bidding records from Discover-Tech's ad system, covering March to June 2026. About 19 percent of the bids were for ads carrying a script that could deliver attack code to a chosen device.
Pakistan ranked second in the world for these bids, with about 139 million. Only Yemen, with about 457 million, was ahead.
The same ads appeared more than 100,000 times on a Pakistani website, whatmobile.com.pk. The report also lists Pakistan among the countries where the ads appeared on government-operated networks, without naming the Pakistani networks.
Citizen Lab also found that a user named "Pindi" logged into Discover-Tech's control platform exclusively from Pakistan. The researchers say they could not conclusively link the user to any spyware company.
Two other unattributed users logged in from India and Italy. A login shows someone used the platform from that country, but it does not show anyone there was targeted.
Seeing an ad does not mean a device was hacked. The report says an ad impression "does not in and of itself confirm targeting or infection".
The data also doesn't show who in Pakistan, if anyone, was chosen as a target. Still, the researchers say the scale shows a serious risk and urge investigations into whether anyone on the affected networks was infected.
The ads also reached networks linked to NATO, the United Nations, and the European Parliament, along with ministries in many countries. Citizen Lab says the problem is built into how online advertising works.
The findings highlight a growing concern regarding the weaponization of digital advertising infrastructure. By leveraging the real-time bidding systems that power modern web ads, malicious actors can bypass traditional security measures.
This method allows for highly targeted surveillance without the victim ever interacting with a malicious link or file. Cybersecurity experts have long warned that the ad-tech ecosystem is vulnerable to exploitation.
The ability to inject malicious scripts into legitimate ad spaces creates a significant challenge for network administrators and individual users alike. The report serves as a stark reminder of the evolving nature of cyber threats in an increasingly connected world.
As investigations continue, the international community is expected to scrutinize the practices of firms like Discover-Tech. The involvement of global institutions like the United Nations and NATO underscores the potential for widespread geopolitical implications.
For now, the focus remains on identifying potential victims and strengthening defenses against such sophisticated digital intrusions.