Pakistan recorded approximately 139,000,000 advertising bids linked to an Israeli spyware delivery operation on 15 October 2026. The operation involved spyware developed by Candiru, which is now known as Integrity Labs.
Nearly 4,000,000,000 advertising bidding records from Discover-Tech’s system between 1 March 2026 and 30 June 2026 were examined by Citizen Lab. Approximately 19% of these bids contained scripts capable of delivering attack code to selected devices.
Yemen recorded approximately 457,000,000 such bids during the same period. The advertisements appeared more than 100,000 times on the Pakistani technology website WhatMobile.com.pk.
Malicious ads also appeared on government-operated networks in Pakistan. Discover-Tech acted as an intermediary between online advertising platforms and spyware developers, allegedly using the infrastructure to distribute Candiru's software.
At least 45 devices belonging to Al Jazeera were targeted through this method during 2024 and 2025. Citizen Lab attributed the attacks to Candiru with high confidence.
A user named “Pindi” accessed Discover-Tech’s control platform exclusively from Pakistan. Two other unattributed users accessed the platform from India and Italy.
Discover-Tech’s advertisements reached networks associated with NATO, the United Nations, the European Parliament, and government ministries in several countries. Google removed Discover-Tech from its advertising platforms.
IAB Europe also removed the company from its approved vendor list.
