ABC and critical infrastructure targeted in spyware campaign Weaponising online ads

Citizen Lab report finds Israel-based firm Discover-Tech exploited ad networks to target Australian media and agencies

By LineZotpaper

Published23 October 2026

Read Time2 min

The Australian Broadcasting Corporation (ABC) has confirmed it was among more than two dozen Australian government agencies, critical infrastructure providers, universities and media organisations targeted in a sophisticated cyber espionage campaign. The campaign, dubbed 'Adfection', was identified by The Citizen Lab, which found that the Israel-based company Discover-Tech exploited online advertising systems to deliver spyware to devices merely by viewing an ad. The ABC said a small number of staff devices were exposed, but no evidence of tracking or compromise has been found.

The ABC confirmed it had wiped affected staff devices as a precaution. "Our review found that ads from this network were shown on a small number of ABC devices. We have found no evidence that any staff member has been identified or tracked," a spokesperson said. The targeted organisations included government networks, critical infrastructure, and media outlets, with the researchers noting a "substantial cluster of impressions" in Australia.

The Citizen Lab's report found that Discover-Tech abused real-time bidding on major ad platforms to serve ads capable of infecting devices. In some cases, viewing the ad could install spyware from another Israeli firm, Candiru. The technique was confirmed to have infected devices at the international news network Al Jazeera.

Australia's Nuclear Science and Technology Organisation (ANSTO) was named as a hot spot for the malicious ads, though an ANSTO spokesperson said it had not identified any impacts. The Australian Signals Directorate declined to comment.

Greens leader David Shoebridge said the report was alarming and raised serious questions about foreign interference, calling for a digital duty of care and stronger privacy reform. University of Queensland Professor Nicholas Carah noted the attack provided proof of the well-known risks embedded in online advertising technology.

Reporters Without Borders has previously highlighted that the use of spyware against journalists is on the rise, underscoring the importance of regular checks for compromise.

Analysis

Why This Matters

The attack weaponises the standard process of online advertising, turning a routine online experience into a potential security risk for journalists, government workers and critical infrastructure operators.
The targeting of the ABC alongside agencies like ANSTO raises serious questions about foreign interference and the vulnerability of Australia’s sensitive networks.
If this method can be successfully exploited by one firm, it presents a replicable model for broader state-level espionage.

Background

The University of Toronto’s Citizen Lab is a leading research organisation that tracks digital espionage against civil society. Commercial spyware, previously linked to firms like NSO Group, has long been a threat. The “Adfection” campaign represents a new frontier by weaponising the programmatic advertising ecosystem, which allows near-instantaneous bidding for ad space. Discover-Tech used this infrastructure to target specific networks, delivering spyware simply by loading a web page and collecting device data regardless of whether infection was achieved.

Key Perspectives

ABC and ANSTO (Affected Organisations): Maintain that they have found no evidence of compromise or tracking, but wiped affected devices as a precaution to protect staff and sources. Citizen Lab (Researchers): Exposed the technical mechanics of the campaign, confirming it successfully infected devices at Al Jazeera and mapping the broad targeting of Australian networks. Greens Leader David Shoebridge and Professor Nicholas Carah (Policy Response and Expert View): Characterised the report as proof of systemic ad tech risks and a foreign interference concern, demanding a digital duty of care and stronger privacy protections.

What to Watch

Response and attribution from the Australian Signals Directorate and other security agencies.
Whether the Australian government moves to include advertising technology within its proposed digital duty of care.
Potential international action against Discover-Tech or the clients who commissioned the campaign.
Further disclosures from major ad platforms on how they will prevent the exploitation of their systems.

Sources

ABC staff targeted in sophisticated cyber attack · Just In

Checked

11 claims in this story checked against 1 source: 7 supported.

Show each claim

Partly supportedThe headline states that ABC and critical infrastructure were targeted in a spyware campaign.Just In: “It can be revealed the ABC is among more than two dozen Australian government, critical infrastructure, universities and media organisations that researchers claim were targeted by an Israel-based company abusing the online advertising system.”
Partly supportedThe summary says Citizen Lab found Discover-Tech exploited ad networks to target Australian media and agencies.Just In: “The Canadian-based group found evidence that company Discover-Tech exploited digital advertising technology from major platforms like those run by Google to deliver spyware that could infect devices merely by viewing an online and without clicking.”
Partly supportedThe ABC confirmed it was among more than two dozen organisations targeted.Just In: “The ABC is among more than two dozen Australian government, critical infrastructure, universities and media organisations that researchers claim were targeted”
Partly supportedDiscover-Tech delivered spyware to devices merely by viewing an ad.Just In: “Discover-Tech exploited digital advertising technology from major platforms like those run by Google to deliver spyware that could infect devices merely by viewing an online and without clicking.”
SupportedThe ABC spokesperson said ads from the network appeared on a small number of ABC devices and no staff member had been identified or tracked.Just In: “Our review found that ads from this network were shown on a small number of ABC devices. We have found no evidence that any staff member has been identified or tracked,”
SupportedThe ABC said it had wiped affected staff devices as a precaution.Just In: “The ABC has wiped staff devices that were exposed to a new, sophisticated cyber attack”
SupportedResearchers confirmed Discover-Tech’s technique infected devices at Al Jazeera with spyware from Candiru.Just In: “Researchers were able to confirm Discover-Tech's technique was used to infect devices at international news network Al Jazeera with spyware from another Israeli company, Candiru.”
SupportedANSTO was identified as a hot spot for malicious ads.Just In: “The report singled out Australia's nuclear science agency, ANSTO, as being a hot spot in their data for the number of malicious ads shown.”
SupportedAn ANSTO spokesperson said it had not identified any impacts.Just In: “An ANSTO spokesperson told the ABC earlier this week it had not identified any impacts.”
SupportedGreens leader David Shoebridge said the report was alarming and raised questions about foreign interference, and called for privacy reform and a digital duty of care.Just In: “Greens leader and digital rights spokesperson David Shoebridge said the report's contents were alarming. "When foreign zero-click adtech is aimed at our public broadcaster, and other sensitive government agencies, that of course raises serious questions about foreign interference," he said, adding that this shows the need for privacy reform and to include advertising in the government's proposed digital duty of care.”
SupportedReporters Without Borders said spyware use against journalists was on the rise and journalists should regularly check their devices for compromise.Just In: “"The use of spyware against journalists is on the rise," international group Reporters Without Borders wrote late last year. "Digital attacks often go unnoticed, so it is vital that journalists regularly check if their devices are compromised."”