Israeli Spyware AdFection: Pakistan Second Most Exposed

Israeli Spyware: One ad, zero clicks. DigiKhi unpacks Israeli Spyware, AdFection, Zero-Click Spyware, and Discover-Tech.

You pay for home broadband every month and open a news site and scroll while ads load around the story. You tap nothing. Now picture a spy tool riding in on one of those ads. As a matter of fact, Citizen Lab reports that this exact attack hit Al Jazeera staff. Your fast connection loads every ad, and you can’t see which ones carry risk. That gap is the problem this guide tackles.

Here is what we found when we dug into the report. You’ll see how this Israeli spyware attack works and why Pakistan ranks second. We also cover what the report does not prove. Above all, you’ll get a simple plan for your phone and your router. Most of it costs little or nothing.

Key Takeaways

• Citizen Lab published its AdFection report on October 15, 2026.
• AdFection uses targeted ads to deliver zero-click spyware, so users need no click.
• Citizen Lab says Discover-Tech, an Israel-based firm, ran the Controlium platform behind the ads.
• Citizen Lab links the attacks to Candiru spyware with high confidence.
• At least 45 Al Jazeera devices were targeted in 2024 and 2025.
• Pakistan recorded about 139 million spyware-linked ad bids, second only to Yemen.
• Per person, Pakistan does not make the report’s top 10 list.
• An ad view alone does not prove targeting or infection.
• No public report names a Pakistani victim yet.
• Google and IAB Europe removed Discover-Tech from their vendor lists in October 2026.
• Apple says most people will never face mercenary spyware.
• Updates, router-level ad blocking, and your phone’s lockdown settings cut your risk.

Key Facts at a Glance

What Is Israeli Spyware and Who Makes It?

Israeli spyware is surveillance software that companies in Israel build and sell. Experts also call it mercenary spyware. Vendors say they sell only to government agencies. Once on a phone, the software can read messages, track location, and switch on the microphone. Researchers, however, have documented its use against journalists and activists. Those cases led to lawsuits and US trade limits.

These tools are rare and expensive. Apple states, “Mercenary spyware attacks cost millions of dollars.” The company also says most people will never face such an attack. Nevertheless, reporters and activists face higher odds. Readers in those fields, including in Pakistan, deserve clear facts.

What Is AdFection?

AdFection is an attack that Citizen Lab named in October 2026. It uses targeted online ads to profile people and silently infect chosen devices with zero-click spyware. The attack basically hides inside the normal ad system. Citizen Lab is a digital forensic research group at the University of Toronto. The group calls AdFection the first technical proof of such infections in the wild. It published its report on October 15, 2026.

How Does AdFection Work?

Websites and apps sell ad space through instant auctions. Advertisers bid in a split second. Discover-Tech bid in these auctions to reach chosen people. For this purpose, its ads carried a small script tag. When the ad appeared, the tag contacted a Discover-Tech server. The tag sent along an advertising ID.

The server then decided whether the device was a target. The researchers say it likely checked the IP address and the advertising ID—a chosen device received hidden code. Everyone else received an empty reply. As a result, ad platforms never saw the harmful code. Their scanners found nothing wrong.

Most people never got the hidden code. The ad still gathered some browser data. Additionally, that data could include cookies and a device’s public IPv6 address. The report adds that the server typically sent code once per target. After that, it returned nothing until operators re-tasked it.

What Is Zero-Click Spyware?

Zero-click spyware needs no tap, download, or click. The infection starts when a device receives or shows something. In AdFection, the ad only has to appear on screen.

The report says,

the simple display of a targeted ad is enough for infection.

In other words, a careful user can still face risk. Pegasus and Graphite have also used zero-click methods.

Phishing needs you to tap a bad link. Zero-click attacks skip that step. Consequently, training alone cannot stop them. Updates, tougher settings, and ad blocking matter more. These steps won’t make you immune, yet they shrink the risk.

Who Is Discover-Tech?

Discover-Tech is an Israel-based company that Citizen Lab says started in 2020. It presents itself as a normal online advertising business. The researchers found no evidence of real advertising work. Discover-Tech did not respond to Reuters. Its side of the story, hence, remains unknown. This article reports these points as claims from researchers.

Scale matters here. Confiant cofounder Jerome Dangu told Reuters that Discover-Tech served “at least 10 million ads per day.” He estimated that hundreds of millions of people likely came across its ads. To put the balance in perspective, Confiant said Candiru-linked ads made up a tiny fraction. The hidden code, remember, reached only chosen targets.

What Is the Controlium Platform?

Controlium is the platform Citizen Lab ties to Discover-Tech. It works like a control panel for ad targeting. Customers can pick a target by mobile ad ID, browser ID, or IP address. In particular, the ad itself carries no exploit code, which helps hide its purpose. Citizen Lab says Candiru used the platform. It also links the platform to two other firms, Bindecy and Intelos.

Candiru Spyware: The Tool Behind the Al Jazeera Attacks

Citizen Lab links the Al Jazeera attacks to Candiru spyware with high confidence. BleepingComputer reports that at least 45 Al Jazeera devices were attacked in 2024 and 2025. Al Jazeera shared network logs with researchers. To demonstrate the link, those logs showed a path from Discover-Tech systems to Candiru servers. Researchers also recovered a file from an infected Windows computer and tied it to Candiru.

Candiru Is Now Integrity Labs

Candiru now operates as Integrity Labs. The US added Candiru and NSO Group to its Entity List on November 3, 2021. BleepingComputer links Candiru to DevilsTongue Windows malware. At the same time, Integrity Labs did not respond to Citizen Lab’s questions. Outlets still use both names, so this guide does too.

Citizen Lab Pakistan Findings: Why Pakistan Ranks Second

Citizen Lab’s October 15, 2026 report counted 139,427,322 spyware-linked ad bids in Pakistan. Only Yemen, with 457,283,658 bids, ranked higher. One Pakistani tech site showed the ads more than 100,000 times. Ads also reached government-operated networks there. Altogether, the data shows heavy exposure to Israeli spyware ads. It does not show confirmed spying.

Also Read: Treacherous Self-Copying AI | Is Pakistan’s TV Safe Now?

Pakistan and Yemen Lead the Ad Bid Count

Citizen Lab counted ad bids that carried the attacker’s script tag. The data covers March to June 2026—the top 10 spans several regions. In general, it shows no single pattern. The table below shows the first five countries from Citizen Lab’s Table 4.

What the Ranking Does Not Prove

A high bid count measures exposure. It does not count victims. Per person, Pakistan does not make the report’s top 10. Montenegro leads that list with 156.68 bids per person, and Yemen follows at 13.99. Comparatively, Pakistan’s large population likely lowers its per-person rate.

Location data has limits too. Citizen Lab warns that IP-based location can be wrong. VPNs and satellite links can blur the map. The ranking, nonetheless, deserves attention. Think of it as a smoke alarm.

Pakistani Websites and Government Networks

A Pakistani tech site, WhatMobile.com.pk, showed the ads more than 100,000 times. The ads also appeared on government-operated networks in Pakistan. The report names no agency. In the final analysis, only network logs can show whether the spyware reached anyone there. Citizen Lab calls for an urgent investigation into such networks.

What Is the Pindi Account?

Citizen Lab found a Controlium user with the handle Pindi. The user logged in only from Pakistan. Citizen Lab could not link the account to any spyware company. Two more users logged in from India and Italy. To clarify, a login location shows where someone connected. It does not show who the targets were.

Did Spyware Reach Anyone in Pakistan?

The question is fair. The honest answer is that the public data can’t say. It shows exposure to ad bids and nothing more. So far, no public report names a Pakistani victim. Investigators still need to check the affected networks.

What Happened to Discover-Tech After the Report?

Google says it ended Discover-Tech’s access to its ad exchange platforms. It also added Safe Browsing protections for domains the attackers control. Subsequently, IAB Europe removed Discover-Tech from its Global Vendor List. Citizen Lab dates that removal to October 8, 2026. Both groups had kept the company on their vendor lists since 2020.

Other ad firms reacted too. Beeswax said it removed Discover-Tech from its Buyer Cloud after a third-party review. Vungle, part of Liftoff, paused all Discover-Tech access while it ran its own review. On the other hand, Eskimi said Discover-Tech’s tags dodged automated scanning. Eskimi also said Discover-Tech spent only a few hundred dollars.

Citizen Lab sees deeper problems. It says vendor certification controls were dangerously inadequate. It also says laws and industry self-rules failed to stop the attacks. In view of this, it asks regulators to investigate whether Discover-Tech and Candiru broke the law.

What Are the Most Well-Known Israeli Spyware Tools Used Globally?

Researchers name four tools most often. They are Pegasus, DevilsTongue, Reign, and Graphite. Most importantly, each one comes from a different company. This section focuses on cases documented by researchers or courts.

Pegasus From NSO Group

NSO Group started in 2010 and makes Pegasus. Al Jazeera reports that Pegasus can harvest location data and control the microphone and camera. NSO says it sells only to state agencies with approval from Israel’s defense ministry. NSO denies wrongdoing. Despite that claim, a 2021 investigation found a leaked list of more than 50,000 numbers.

The Pegasus Project published its findings on July 18, 2021. The leaked list covered numbers that clients picked in more than 50 countries since 2016. The list, in essence, shows interest in a target, not proof of infection. Amnesty’s Security Lab tested phones. It found infections or attempts on 85 percent of them. NSO disputed the reporting.

In October 2025, a US judge permanently barred NSO from targeting WhatsApp. CyberInsider reports that a 2019 campaign hit about 1,400 users. A jury had awarded Meta $167 million in punitive damages. Thereupon, the judge cut the total award to just over $4 million.

Reign From QuaDream

QuaDream made the Reign tool. Citizen Lab and Microsoft exposed it in April 2023. Reign hit the iPhones of at least five members of civil society. Furthermore, the ENDOFDAYS exploit used fake iCloud calendar invites. Bitdefender, citing Calcalist, reports that QuaDream shut its office.

Graphite From Paragon

Paragon, an Israeli company, makes Graphite. A June 2025 report found Graphite on the iPhones of at least two journalists. The attacks needed no clicks. Updates matter, after all. Apple fixed the flaw, CVE-2025-43200, in iOS 18.3.1. Patches close these doors.

How Can I Detect Sophisticated Surveillance Software on My Phone?

Detection is hard. Al Jazeera says Pegasus hides from users. Most spyware of this kind leaves no visible sign. Rapid battery drain, overheating, or unusual data usage can hint at trouble. Generally, those signs have normal causes too, so do not panic.

Apple gives one clear signal. It sends threat notifications to users it believes mercenary spyware may have targeted. The alert can show on your Lock Screen. It can also arrive by email. A banner may appear after you sign in at account.apple.com. Besides, Apple treats these alerts as high-confidence. It won’t reveal what triggered yours, so attackers can’t adapt.

Only a forensic check gives a firmer answer. Amnesty’s Security Lab released the Mobile Verification Toolkit, or MVT, in July 2021. The tool looks for traces of spyware on Android and iOS devices. It is powerful, but its own maintainers say it is not for end-user self-checks. A clean result also can’t prove a phone is safe.

Are There Independent Experts Who Can Check My Phone for Advanced Intrusions?

Yes, and access depends on who you are. Access Now runs a free Digital Security Helpline that works around the clock. It serves civil society, particularly journalists, activists, and human rights defenders. The group says it answers every request within two hours. Apple points people at risk to this helpline too.

Amnesty’s Security Lab and Citizen Lab also do forensic work. In the Pegasus Project, Amnesty’s lab analyzed phones, and Citizen Lab peer-reviewed the results. Each team sets its own rules for who it helps. Of course, you should read those rules before you write.

Readers in Pakistan can call the Digital Rights Foundation helpline at 0800-39393. You can also email helpdesk@digitalrightsfoundation.pk. The group says its help is free and confidential. Its page doesn’t list phone checks as a service. Accordingly, ask the team to point you to a forensic expert.

Where to Download Updates for Spyware Detection Software Targeting Israeli Spyware?

No tool hunts only Israeli spyware. Detection tools look for signs from many spyware families. They use lists that experts call indicators of compromise. In brief, the lists name suspicious domains, files, and behaviors.

Download MVT only from official sources. Its documentation lives at docs.mvt.re, and the package lives at pypi.org/project/mvt. You install it with the command pip install mvt. To emphasize the point, update its indicators with the download-iocs command before each scan. Version 3 changed some commands, so check the docs.

Detection software is only half the job. On iPhone, your phone needs updates too: open Settings > General, then Software Update. Equally, Android users should update, and menus vary by brand. Apple fixed the Graphite flaw in iOS 18.3.1, which shows why updates matter.

What Are the Best Spyware Protection Services Specializing in Threats From Israeli Software?

No service can promise full protection from zero-click spyware. Treat any product that makes that promise with caution. No single step stops everything. The best layers, chiefly, cost nothing. They are updates, Lockdown Mode (Android’s extra protection mode), and expert help.

Paid mobile security apps exist, and some detect common threats. Ask each vendor for independent test results before you pay. Also ask what the app can check on your phone. In short, start with the free protections in Apple and Google software. They cost nothing.

How to Protect Your Phone and Home Network From Zero-Click Spyware Ads?

PPC Land reports that Citizen Lab calls gateway ad blocking the most feasible protection. That advice targets government and infrastructure networks. In light of that advice, home users can copy the idea at home. Your router acts as your home gateway.

Block Ads on Your Broadband Router

Use a Protective DNS Service

A DNS service turns website names into addresses. Some services also refuse known ad and tracker domains. Set one on your router, and every device on your Wi-Fi gets the filter. Explicitly, it works only at home, not on mobile data. It also can’t catch every ad.

Add a Browser Ad Blocker

A browser ad blocker protects you away from home. Install one from your browser’s official store. Pick a well-known blocker with public reviews. At this point, you cover both your home Wi-Fi and your browser. Keep the blocker updated so it learns new ad domains.

Keep Every Device Updated

Install system updates on your phone, laptop, and router. Router makers release security fixes too. Turn on automatic updates where you can. Henceforth, treat update prompts as security steps. Researchers tie Candiru, QuaDream, and Paragon tools to software flaws.

Add Extra Phone Protection

iPhone Lockdown Mode

Apple built Lockdown Mode for a small group of high-risk people. Open Settings, then Privacy & Security, then Lockdown Mode. On the positive side, it blocks most message attachments and some web features. Tap Turn On Lockdown Mode, then restart. The tradeoff is real, and some sites load slowly or look broken.

Android Extra Protection Mode

Android 16 added an extra protection mode for high-risk users. EFF says it turns on tighter settings, such as Chrome’s HTTPS-only Mode and the no-unknown-app-installs setting. Open Settings, then Security and Privacy, and look for the extra protection option. To illustrate the trade-offs, some sites may break. Call screening may also flag real calls. Menu names vary by phone.

Frequently Asked Questions About Israeli Spyware and AdFection

Is AdFection Real?

Citizen Lab says it is real, with high confidence for the Al Jazeera cases. Reuters and BleepingComputer report the same findings. Discover-Tech has not answered publicly. In truth, courts and regulators must still weigh every claim. Treat this article as a report of allegations.

Can an Online Ad Infect My Phone Without a Click?

Yes, in rare targeted cases. Citizen Lab says AdFection needs only an ad to display. The server selects targets based on advertising ID and IP address. To repeat, the server never picks most people. Apple says the same about mercenary spyware.

Is Israeli Spyware Legal to Sell?

The answer depends on the country and the buyer. NSO says it sells to state agencies with approval from the Israeli Defense Ministry. The US added NSO and Candiru to its Entity List in November 2021. On the whole, Citizen Lab says existing laws failed to stop these attacks. It asks regulators to investigate.

Does Seeing a Spyware Ad Mean Someone Hacked Me?

No. An ad view alone does not prove targeting or infection. Citizen Lab says the server did not select most users. Code arrived only if the server picked your device. If you have real worries, ask an expert to check.

Which Countries Had the Most Spyware-Linked Ad Bids?

Citizen Lab’s report ranks Yemen first with 457,283,658 bids. Pakistan follows with 139,427,322. Montenegro, Brazil, and Mexico complete the top five. To list the next group, China, Belarus, Armenia, Czechia, and Israel fill places six to ten. Those counts cover March to June 2026.

Who Is Behind AdFection?

Citizen Lab names Discover-Tech, an Israel-based firm, as the ad company behind AdFection. It links the infections at Al Jazeera to Candiru spyware. Candiru now operates as Integrity Labs. Discover-Tech and Integrity Labs did not respond to Citizen Lab’s questions. Accordingly, Citizen Lab asks regulators to investigate whether either firm broke the law.

How Can I Block Spyware Ads at Home?

Switch your router’s DNS to a protective service that refuses known ad and tracker domains. Then add a browser ad blocker on each device. Keep phones, laptops, and the router updated. To sum up, router filtering covers your home Wi-Fi. A browser blocker covers you on the go. These steps cut risk, yet they cannot stop every ad.

Conclusion

Citizen Lab’s AdFection report shows how ordinary ads can carry Israeli spyware into rare, targeted attacks. Pakistan ranks second in raw exposure, yet no public report names a Pakistani victim. In conclusion, treat the ranking as a warning. Update your devices and filter ads at your router. If you face higher risk, turn on your phone’s lockdown settings too.

For more updates, Latest News, and Digital Marketing Services, email us at contact@digikhi.com. Or visit our website (https://www.digikhi.com).

Sources

• Citizen Lab, Exposing AdFection (full report): https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/
• Citizen Lab, Exposing AdFection Executive Summary: https://citizenlab.ca/research/exposing-adfection-executive-summary/
• BleepingComputer, Targeted ads installed Candiru spyware in zero-click attacks: https://bleepingcomputer.com/news/security/zero-click-attacks-used-targeted-ads-to-deliver-candiru-spyware
• Dark Reading, AdFection Turns Ad Impressions Into Zero-Click Spyware Delivery: https://www.darkreading.com/data-privacy/adfection-online-ads-spyware-delivery.
• Reuters via The Express Tribune, Israeli firm used online ads to run vast spy operation: https://tribune.com.pk/story/2635015/israeli-firm-used-online-ads-to-run-vast-spy-operation-researchers-say
• Profit by Pakistan Today, Pakistan ranks second globally in exposure to Israeli spyware-linked online ads: https://profit.pakistantoday.com.pk/2026/10/22/pakistan-ranks-second-globally-in-exposure-to-israeli-spyware-linked-online-ads-citizen-lab-finds
• ProPakistani, Pakistan among most targeted countries in Israeli spyware campaign: https://propakistani.pk/2026/10/22/pakistan-among-most-targeted-countries-in-israeli-spyware-campaign/amp/
• PPC Land, Google drops ad vendor it listed since 2020: https://ppc.land/google-drops-ad-vendor-it-listed-since-2020-after-45-device-spyware-attack/
• Computer Weekly, Spyware firm NSO and others added to US banned Entity List: https://www.computerweekly.com/news/252509004/Spyware-firm-NSO-and-others-added-to-US-banned-Entity-List
• CyberInsider, US court blocks spyware vendor NSO Group from targeting WhatsApp users: https://cyberinsider.com/us-court-blocks-spyware-vendor-nso-group-from-targeting-whatsapp-users/
• Al Jazeera, What you need to know about Israeli spyware Pegasus: https://www.aljazeera.com/news/2022/2/8/what-you-need-to-know-about-israeli-spyware-pegasus
• Forbidden Stories, About the Pegasus Project: https://forbiddenstories.org/about-the-pegasus-project/
• Infosecurity Magazine, European journalists targeted by Paragon spyware: https://www.infosecurity-magazine.com/news/european-journalists-paragon/
• Bitdefender, Spyware maker QuaDream closes shop: https://www.bitdefender.com/blog/hotforsecurity/spyware-maker-quadream-closes-shop-after-researchers-blow-the-lid-off-its-operations/
• Apple Support, About Apple threat notifications and protecting against mercenary spyware: https://support.apple.com/en-us/102174
• Apple Support, About Lockdown Mode: https://support.apple.com/en-us/105120
• EFF, Google’s new protection mode arrives on Android: https://www.eff.org/deeplinks/2025/06/googles-advanced-protection-arrives-android-should-you-use-it
• Access Now, Digital Security Helpline: https://www.accessnow.org/help/
• Digital Rights Foundation, Pakistan: https://digitalrightsfoundation.pk/
• Mobile Verification Toolkit on PyPI: https://pypi.org/project/mvt/
• Mobile Verification Toolkit documentation: https://docs.mvt.re/en/latest/

Disclaimer: This article offers general information only. It reports findings and allegations from Citizen Lab and news outlets. It does not accuse any person or company of a crime. Facts may change as investigations continue. Check the sources before acting on any claim. Nothing here counts as legal, security, or professional advice.