Pakistan has been linked to a large number of online advertising bids connected to the delivery of Israeli spyware, according to a report by Citizen Lab. The report highlights concerns about how digital advertising systems can potentially be used to deliver harmful software and how ordinary internet activity may become part of a wider surveillance system.
The reported figure of 139 million advertising bids linked to Pakistan has raised questions about online privacy, digital security, and the role of advertising technology in the spread of spyware. While online advertisements are normally used to promote products, websites, and services, the same systems can also create opportunities for attackers to target selected devices and users.
The findings are important for Pakistan because millions of people use smartphones, social media platforms, websites, and mobile applications every day. Many of these services depend on digital advertising to earn money. If advertising systems are misused to support spyware delivery, users may face privacy risks without knowing that their online activity is being used in this way.
However, the reported number of ad bids should not be taken as proof that 139 million Pakistani citizens were infected with spyware. Advertising bids are digital transactions or requests connected to the buying and selling of advertising space. They do not automatically mean that an advertisement was displayed, a person clicked on it, or a device was infected.
What Does the Citizen Lab Report Reveal?
Citizen Lab is a research group known for studying digital security, internet censorship, surveillance, and threats against people who may be targeted by powerful monitoring tools. Its investigations have examined spyware and the ways digital technology can be used to track individuals.
The reported link between Pakistan and 139 million advertising bids associated with Israeli spyware delivery draws attention to a less familiar side of online advertising. Most internet users see advertisements as ordinary promotional messages, but the technology behind them involves a complex network of advertisers, advertising exchanges, data providers, and websites.
These systems often work automatically. When a user opens a website or an application containing advertising space, the system may send information about the available space to advertising platforms. Advertisers or their technology partners can then compete to show an advertisement to that user.
This process is commonly known as real-time bidding. It allows advertising companies to make decisions within a very short period, often before the advertisement appears on the screen.
The concern raised by reports of spyware-related advertising activity is that this large and complicated system may be misused. Under certain conditions, advertising infrastructure can become part of a chain used to deliver malicious content or direct a selected user towards a harmful destination.
The exact technical details matter when interpreting the findings. A link between ad bids and spyware delivery does not, by itself, establish that every bid involved a malicious advertisement or that all activity resulted in a successful attack.
Understanding the 139 Million Ad Bids
The figure of 139 million is striking, but it is important to understand what an advertising bid actually represents.
An ad bid is part of the process through which advertising space is offered and purchased online. When a website or application has space for an advertisement, its advertising system may send a request to a marketplace. Interested buyers can submit bids, and the system selects an advertisement according to its rules.
A large number of bids can be generated through routine internet activity. The same person may trigger multiple advertising requests while browsing different pages, opening applications, or using online services. A single device can therefore be connected to many advertising transactions.
For this reason, the number of bids should not be confused with the number of users, devices, advertisements shown, or spyware infections.
The reported figure points to the scale of advertising activity associated with the investigation. It does not independently reveal how many people were targeted, how many devices were exposed, or how many attacks were successful.
Understanding this difference is essential for accurate reporting. Large numbers can help show the possible reach of an advertising system, but additional technical evidence is needed to measure the real impact on users.
For Pakistan, the findings raise a broader question: how much visibility do local users have into the advertising networks operating on their devices, and what protections exist if those networks are used for purposes beyond ordinary marketing?
How Online Advertising Can Be Misused
Digital advertising has become a major part of the modern internet. Free news websites, video platforms, mobile games, and many other services use advertisements to cover their costs.
The advertising process often depends on several companies working together. A publisher provides the advertising space, an exchange manages bids, and an advertiser or advertising partner pays to place content in front of a selected audience.
Because these processes involve many different parties, it can be difficult for users to understand where an advertisement comes from or how it was selected for them.
This complexity can also create security challenges. If a dishonest party gains access to an advertising system, abuses a legitimate service, or places harmful content through a weak point in the process, the advertising chain may become a route for unwanted activity.
In some cases, harmful advertisements can direct users to websites that attempt to steal information or install unwanted software. More advanced attacks may use weaknesses in a browser, operating system, or other software to reach a device.
Spyware is especially concerning because it may be designed to collect information secretly rather than simply display unwanted advertisements. Depending on the type of spyware and the access it gains, it may be able to gather private messages, contacts, location information, browsing activity, or other sensitive data.
Not every malicious advertisement delivers spyware, and not every advertising request represents a threat. The risk depends on the methods used, the technology involved, the security of the target device, and whether the attack succeeds.
The Citizen Lab findings therefore draw attention to the need for closer examination of advertising systems that may be connected to surveillance technology.
What Is Israeli Spyware?
Spyware is software designed to collect information from a device without the user’s clear knowledge or meaningful consent. It can be used for different purposes, including unauthorised monitoring and the collection of private information.
The term Israeli spyware refers to spyware products or operations associated with companies or developers based in Israel. Israel has become known internationally for its commercial surveillance technology industry, including tools designed for monitoring mobile phones and other digital devices.
Some commercial spyware products have attracted international attention because of concerns about their use against journalists, human rights workers, political figures, and other individuals. Security researchers have investigated cases in which surveillance tools were allegedly used beyond legitimate law-enforcement purposes.
However, the term should not be treated as proof that the Israeli government was directly responsible for every spyware-related activity. Establishing responsibility requires evidence about the companies, operators, customers, and technical systems involved in a specific case.
Likewise, the presence of advertising bids connected to spyware delivery does not automatically establish that every Pakistani user involved in the advertising process was deliberately selected for surveillance.
Pakistan’s digital services are growing, with people using mobile phones for banking, shopping, education, news, communication and business. Government departments and private companies also depend on online systems to manage information and provide services.
As more daily activities move online, protecting digital privacy becomes increasingly important.
The Citizen Lab findings highlight the need to check whether advertising networks operating in Pakistan meet strong security standards. They also raise questions about how third-party advertisements are reviewed before they appear on websites and mobile applications.
For government organisations, the findings are a reminder that internet access itself can create security risks if devices are not properly protected. A government employee does not need to visit a suspicious website deliberately for an advertising-based attack to become a concern.
For ordinary users, the report shows why digital safety cannot depend only on avoiding unknown links. Some advanced attacks may use advertisements that appear on familiar websites or applications.
However, there is no evidence in the reported Pakistan figures proving that a particular Pakistani citizen was infected. The findings should encourage careful investigation rather than unnecessary fear.
What Can Pakistani Internet Users Do to Stay Safe?
Although users cannot control every part of the online advertising system, they can take practical steps to reduce their exposure to digital threats.
- Keep your phone updated.Install security updates for Android or iOS as soon as they become available. Updates often fix weaknesses that attackers may try to use.
- Update your applications.Use official app stores to install updates and avoid downloading applications from unknown websites. Older versions may contain security problems that have already been fixed.
- Use a trusted browser.Choose a browser that provides security warnings and protection against known harmful websites. Do not ignore serious warnings about suspicious pages.
- Review app permissions.Check which applications can access your camera, microphone, contacts, location and other private information. Remove permissions that an app does not need.
- Avoid unknown downloads.Do not install files or applications simply because an advertisement claims that your phone needs an urgent update or special security tool.
- Use strong account security.Protect important accounts with unique passwords and two-step verification wherever possible. This can reduce the risk of account theft, although it cannot prevent every spyware attack.
- Watch for unusual behaviour.Unexpected battery drain, overheating, unfamiliar applications or unusual data use can have many causes. These signs alone do not prove that spyware is present, but persistent problems may justify a security check.
Users should also understand that no single precaution guarantees complete protection against advanced spyware. Some sophisticated attacks may work without a click or any obvious warning.
What Should Authorities and Advertising Companies Do?
The findings point to a wider responsibility for advertising platforms, website owners, cybersecurity teams and government authorities.
Advertising companies should strengthen checks on businesses that purchase advertising space and monitor suspicious activity. They should also be able to remove harmful advertisements and block accounts that misuse their services.
Website owners can review their advertising partners, apply available security controls and respond quickly when researchers report suspicious content. Publishers should also make sure that their advertising arrangements do not expose visitors to unnecessary risks.
For Pakistan, relevant cybersecurity authorities could examine whether the affected government-operated networks experienced any successful attacks. Such an investigation would need reliable technical evidence, including available device records, network logs and signs of attempted exploitation.
Authorities should avoid treating the number of bids as a count of victims. Instead, they should focus on determining whether any devices were targeted, whether an attack succeeded and what steps are needed to protect affected systems.
International cooperation may also be important because advertising networks, spyware developers and their customers can operate across different countries.
Greater transparency from advertising platforms could help independent researchers understand how suspicious advertisements move through the online ecosystem. Stronger oversight could also make it harder for surveillance companies to use ordinary advertising services as a route to targeted attacks.
Conclusion
Citizen Lab’s investigation has highlighted a serious digital security concern involving Pakistan. The country recorded approximately 139.4 million advertising bids associated with a system linked to Israeli spyware delivery, placing it second in the report’s global ranking by total bid volume, behind Yemen.
The investigation linked the advertising technology company Discover-Tech to a system capable of directing selected devices towards spyware attacks through online advertisements. Researchers also found that relevant advertisements appeared more than 100,000 times on Pakistani website WhatMobile and reached some government-operated networks.
However, the available data does not prove that 139 million people were targeted or that any particular number of Pakistani phones was infected. The identity of the user account called Pindi also remains unconfirmed.
The confirmed spyware attacks documented by Citizen Lab show why the issue deserves attention. At the same time, the distinction between advertising activity, attempted targeting and successful infection must remain clear.
Pakistan’s next step should be to improve digital security, examine potentially affected networks and encourage stronger protections across the online advertising industry. As online services continue to expand, protecting users’ personal information must remain a key priority.
Ultimately, the report is a warning about how everyday internet technology can be misused. It is not proof of widespread spyware infections in Pakistan, but it provides a strong reason for further investigation and better protection of digital privacy.
Frequently Asked Questions (FAQs)
1. How many spyware-linked advertising bids were recorded in Pakistan?
Citizen Lab recorded approximately 139.4 million relevant bids associated with Pakistani IP addresses between March and June 2026.
2. Did Pakistan rank first in the report?
No. Pakistan ranked second by total number of bids, behind Yemen, which recorded approximately 457 million.
3. Were 139 million Pakistani phones hacked?
No. The figure represents advertising bids, not unique people, devices or confirmed spyware infections. The report did not establish how many Pakistani devices, if any, were successfully infected.
4. What is AdFection?
AdFection is the name Citizen Lab gave to an advertising-based method that can use targeted online advertisements to deliver spyware. In a zero-click attack, a person may not need to click the advertisement for the attack to begin.
5. Did the suspicious advertisements appear on a Pakistani website?
Yes. Citizen Lab reported more than 100,000 impressions on whatmobile.com.pk. This finding does not prove that the website’s owners knowingly participated in the activity or that its visitors were infected.
6. What should Pakistani users do to protect their phones?
Users should keep their phones and applications updated, review app permissions, avoid unknown downloads and use trusted security features. These steps improve protection, although they cannot guarantee safety against every advanced spyware attack.
7. Has Citizen Lab identified a Pakistani spyware victim?
The reported advertising data did not identify a confirmed Pakistani victim. Researchers called for further investigation to determine whether anyone on affected networks had been infected.
Read Also: check
