Citizen Lab says ad-tech spyware campaign targeted Australian nuclear and government networks

Researchers say a sophisticated spyware campaign used online advertising technology to target millions of devices, including systems linked to Australia's nuclear science agency and other government and critical infrastructure organisations. The incident was described as an unprecedented attack that relied on ordinary-looking ads to deliver spyware or back doors when viewed on websites or in apps. The findings were published by Citizen Lab, a research group at the University of Toronto that investigates cyber espionage and surveillance operations.

According to the report, the campaign involved an Israel-based company that allegedly exploited digital advertising infrastructure to compromise devices through ad delivery mechanisms. Citizen Lab said the operation affected millions of devices and included networks belonging to the Australian Nuclear Science and Technology Organisation, as well as other Australian government agencies, critical infrastructure bodies and major media organisations. A spokesperson for ANSTO said it had not identified any impact to its systems from the techniques described in the report.

The researchers said the attack was notable because it used a common part of the online advertising ecosystem to create access to devices without requiring a user to click on a malicious link. Deakin University associate professor Diarmaid Harkin, who studies the spyware industry, said the case showed how bad actors were using online infrastructure to compromise opponents. He said normal advertising technology typically runs a small amount of code in browsers and apps to display ads, but in this case that mechanism was allegedly abused.

The case matters because it points to a wider security risk for institutions that rely on commercial digital advertising systems, including public agencies and critical infrastructure operators. If the findings are confirmed, the campaign would show how surveillance tools can be distributed through everyday online services rather than through more easily detected phishing or malware campaigns. That raises questions about oversight of the advertising industry and the resilience of systems that sit behind routine web and app traffic.

As an Amazon Associate we earn from qualifying purchases.

Citizen Lab said it had identified what it described as bad actors using online advertising to infect devices through a report titled "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware." The group said the operation was linked to an Israel-based company and that the ads could trigger spyware delivery simply by being viewed. The report also said the campaign was designed to track devices at scale, rather than focus on a single target. The Australian institutions named in the report were not the only ones said to be affected.

Citizen Lab said the campaign also reached other government agencies, critical infrastructure organisations and major media outlets, suggesting a broad targeting pattern. That breadth may complicate efforts to assess the full extent of exposure, especially where systems were touched but no immediate impact has yet been identified. What remains unclear is how many devices were successfully compromised, what data may have been accessed, and whether any Australian systems suffered lasting damage.

It is also not clear from the report whether the alleged campaign is still active or whether any remediation has been completed across the affected networks. The next developments to watch are any further responses from the named organisations, additional technical findings from researchers, and whether regulators or governments move to scrutinise the advertising infrastructure involved.

#Australia #CitizenLab #spyware #cybersecurity #ANSTO