Pakistan cyber threats are coming from five directions at once, and their reach differs sharply. Some aim at a small set of specialist bodies, while others reach ordinary people through their devices, online accounts and public websites. Monitoring bodies and security researchers have documented each one, but their real-world impact is far from equal.
Espionage and spyware ads
Security researchers at InfraHunter said on November 1 that they had found an exposed server holding a complete intrusion toolkit. They linked it to a group called APT-C-35, also known as DoNot or Viceroy Tiger, which researchers have long connected to Indian state backing. The firm Brinztech confirmed the findings the next day.
The tools contain built-in references that name PAEC (the Pakistan Atomic Energy Commission), KANUPP, OGDCL and Chashma as intended targets. The kit also includes tools for harvesting login credentials, remote-access shells, and scripts that scout SCADA systems, the industrial control networks used by utilities. That focus fits the group's record of targeting defence bodies in South Asia.
The reach, however, appears narrow, with the pool of potential targets likely running into the hundreds. Ordinary internet users are unlikely to see this threat directly. For employees at the named organisations, though, the security implications are serious.
Citizen Lab, a research group, released a report on October 15 describing a campaign run by the Israeli firm Discover-Tech. The firm placed online advertisements that carried Candiru spyware to devices it had selected. Pakistan placed second worldwide for hostile ad bids, numbering roughly 139 million from March to June 2026. Yemen was the only country ahead of it, with 457 million.
The report placed the ads on well-known Pakistani sites, among them WhatMobile, and on government-run networks. Citizen Lab also said a bid is not the same as an infection. An impression of an ad does not by itself show that a device was targeted, so the 139 million figure should not be read as a count of compromised phones or computers.
Discover-Tech stopped operating its platforms in August 2026. In October, Google took the firm off ad exchanges, which closes this route, though devices infected earlier may still carry the spyware.
Stolen logins, ransomware and defacements
Stolen logins may be the most immediate risk for everyday users. According to ThreatMon, roughly 760,000 Pakistan-linked logins were found in infostealer logs in 2026. Of these, 57.6% pointed to .gov.pk domains, among them the FBR (the tax agency), Punjab government and NADRA portals.
The logins were harvested from compromised personal gadgets rather than through direct breaches of state systems, yet each one can give an attacker quick access to sensitive records. One stolen session token linked to NADRA, the national registration authority, could open the door to identity theft on a large scale.
ThreatMon also identified seven ransomware cases involving Pakistani victims in 2026. Healthcare accounted for three of them, making it the most affected sector by a wide margin. Several groups, among them APT73, Qilin and DragonForce, have claimed Pakistani targets, alongside NightSpire and The Gentlemen.
In these attacks, criminals typically encrypt systems first, then demand payment to keep stolen data from being published, a method known as double extortion. A single hospital cut off from its systems can put patients at direct risk. Because Pakistan has few rules requiring breaches to be disclosed, the seven confirmed cases probably understate the true number.
National CERT, the national computer emergency response team, has recorded more than 1,000 attacks spanning 2024 to 2026. Separately, the Pakistan Telecommunication Authority's dark-web monitoring from July 2025 to June 2026 identified 326 notable threat signals. Of these, 53% were website defacements and 27% were data leaks.
Government and university sites are the most common targets in both datasets, and incidents rise around national days, such as 14 August and 6 September. Defacements mostly harm institutional websites. Leaked university data, however, can fuel phishing and fraud for months afterward.
A stretched defence
National CERT has roughly 70 staff across the country and uses AI for about 30% of its monitoring work. That volume puts strain on a thin layer of defence. PTA, the telecom regulator, has also warned about risks to Pakistan's coming 5G networks, including theft of subscriber information and attacks on core networks.
Taken together, Pakistan cyber threats are ongoing, come from several sides and are rising faster than the means available to counter them.
Aasan alfaaz mein
Pakistan mein internet istemal karne walay logon ko ab paanch alag cyber khatray dekhne ko mil rahe hain. Sab se aam khatra chori hone wale logins ka hai, jin ki tadad 2026 mein lagbhag 760,000 rahi. Spyware walay ads ka rasta band ho chuka hai, lekin pehle infect hone wale devices ab bhi khatre mein ho sakte hain. Apne passwords mazboot rakhein aur shak wale links par click karne se pehle ehtiyaat karein.
