In a cybersecurity investigation examining programmatic ad-tech exploitation, the University of Toronto’s Citizen Lab has identified Pakistan as the second-largest global target of an ad-delivered zero-click spyware infrastructure operated by Israeli surveillance firm Discover-Tech in coordination with mercenary spyware vendor Candiru (rebranded as Integrity Labs / Saito Tech).

The investigation reveals that between March and June 2026, researchers analyzed nearly four billion commercial digital ad bidding records. Pakistan logged approximately 139 million malicious ad bids carrying intrusive script tags—trailing only Yemen (~457 million bids) globally. Together, the two nations accounted for nearly four out of every five flagged bids recorded in the dataset.

The “AdFection” Attack Vector: No Click Required

Unlike conventional phishing attacks that rely on deceptive SMS links, WhatsApp bait, or malicious file attachments, the technique—dubbed AdFection by Citizen Lab—converts standard programmatic web advertising into a silent delivery pipeline:

[User Visits Mainstream News Site / Mobile App Running Programmatic Display Ads]
                                        │
                                        ▼
[Ad Auction Wins ➔ Script Embedded in Display Ad Executes in App / Browser]
                                        │
                                        ▼
[Code Contacts Discover-Tech "NOAS" Server with Device ID, Advertising ID & IP]
                                        │
        ┌───────────────────────────────┴───────────────────────────────┐
        ▼                                                               ▼
[Non-Targeted Public User]                                   [Identified Target Device]
• Receives blank/ordinary ad code                             • Invisible frame routes to Candiru Validator
• Unaffected by malicious payload                             • Evaluates OS version, browser vulnerabilities
                                                              • Deploys zero-click kernel exploit payload

1. Silent Background Execution: When an ad unit renders on a smartphone or desktop browser, embedded JavaScript executes automatically.
2. Device Profiling: The script transmits the device’s unique Mobile Advertising ID (MAID), cookie identifiers, and IP address to Discover-Tech’s “NOAS” (getAd) infrastructure.
3. Selective Exploit Delivery: While general users received inert code, selected target devices were redirected via hidden iframes to Candiru validator servers, which screened system configurations before delivering full command-and-control spyware payloads.

Targets & Public Sector Footprint in Pakistan

Citizen Lab traced ad impressions across 120,000 websites and 75,000 mobile applications worldwide. In Pakistan, the intrusive ad bids were detected on local media portals, technology websites, and government-operated IP network blocks.

The forensic logs also documented a specific operator console account handle labeled “Pindi”, which accessed Discover-Tech’s backend Controlium surveillance management system exclusively from IP addresses within Pakistan.

While Citizen Lab emphasizes that an ad impression represents exposure and profiling rather than guaranteed device compromise, the exposure of 139 million bids indicates systemic vulnerability across Pakistan’s domestic digital advertising ecosystem.

Following the release of the findings, global ad networks including Google and IAB Europe removed Discover-Tech from their certified partner registries and terminated its access to ad exchanges.

Recommended Security Controls

For professionals, corporate leaders, and international applicants managing sensitive travel documents, banking assets, and identity files, standard anti-phishing caution is insufficient against zero-click ad vectors. The following defensive measures reduce attack surfaces:

• Deploy Network-Level & Browser Ad Blockers: Install robust content-filtering extensions (such as uBlock Origin or Privacy Badger) and configure DNS-level ad-blocking (such as NextDNS or Pi-hole) to prevent ad scripts from loading.
• Reset or Disable Mobile Advertising IDs: On Android devices, navigate to Settings → Google → All Services → Ads and delete your Advertising ID. On iOS, disable Allow Apps to Request to Track under Privacy & Security.
• Enable High-Security Device Modes: Turn on Lockdown Mode on iOS/macOS devices handling sensitive legal or corporate data, which disables complex web technologies and just-in-time JavaScript compilers frequently exploited by ad-tech spyware.
• Keep Browsers & Operating Systems Patched: Zero-click browser exploits depend on unpatched zero-day vulnerabilities. Enable automatic updates across all mobile and workstation operating systems.