Researchers expose spyware campaign that weaponised online ads against millions of devices

Australian nuclear agency among targets in what Citizen Lab calls an unprecedented attack

By LineZotpaper

Published19 October 2026

Read Time3 min

University of Toronto researchers say an Israel-based company secretly weaponised online advertising to profile millions of devices and install spyware, with Australian government agencies, critical infrastructure and the Australian Nuclear Science and Technology Organisation among the targets.

University of Toronto researchers have exposed what they describe as an unprecedented cyber espionage campaign that turned targeted online advertising into a pipeline for spyware, reaching millions of devices including some on Australian government, nuclear research and critical infrastructure networks.

The Citizen Lab, in a report titled Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware, said the Israel-based company exploited the code that normally runs in browsers and apps to display ads, using it to profile devices, track web activity and install software that acted as a back door into phones and computers. The technique allowed access to passwords, emails and details of internal systems, and required no click from the victim.

The lab said Discover-Tech bid in online advertising auctions to show ads on websites and apps including Duolingo, the BBC and the New York Times. Merely viewing an ad did not guarantee infection, the researchers said, only that a device had been exposed to the exploit.

Among targets, the report highlighted a "substantial cluster" of impressions in Australian critical infrastructure, government, university and media networks, and named the Australian Nuclear Science and Technology Organisation (ANSTO) and its Australian Synchrotron research campus. It did not name most other Australian targets. The lab said it verified that devices belonging to the news network Al Jazeera moved from viewing an infected ad to making contact with servers run by spyware maker Candiru, to having files installed.

ANSTO said it was aware of the reports but had identified no impact on its systems. "We are following standard response processes and have not identified any impact to our facilities, systems, and information from the techniques described in the reports," a spokesperson said. The Department of Home Affairs directed inquiries to the Australian Signals Directorate, which declined to comment.

Discover-Tech is said to have acted as a go-between for advertising platforms and spyware and hacking companies, including Candiru, which is under US export controls for its "malicious cyber activities". The report said Google removed Discover-Tech from its platform after the findings were shared. Google was approached for comment.

Deakin University associate professor Diarmaid Harkin, who researches the spyware industry, said the case showed how online advertising infrastructure could be used against targets. "This is a demonstration of how the online advertising industry is not only being used to surveil, but also is being exploited for what looks like espionage," he said. He asked who was acting as a watchdog for digital advertising systems.

Analysis

Why This Matters

Anyone who views online ads could be exposed: the exploit needed no click, only an ad impression, and the campaign reached millions of devices.
The attack targeted critical infrastructure and nuclear research agencies, raising questions about the security of organisations that run sensitive government work.
It exposes a gap in the digital advertising industry: the same systems that deliver ads can be weaponised to profile and infect devices, and the question of who polices them is unresolved.

Background

The Citizen Lab is a University of Toronto research group that has uncovered multiple cases of mercenary spyware used against governments, media and civil society. Discover-Tech is alleged to have participated in real-time advertising auctions, buying the right to display ads on major websites and apps and attaching hidden code to otherwise benign-looking creatives. Spyware maker Candiru has been placed under US export controls because of its malicious cyber activities. The report's findings were shared with Google, which removed the company from its platform.

Key Perspectives

Citizen Lab and researchers: They argue the advertising ecosystem is being weaponised at massive scale to profile millions of users and silently deliver spyware to selected targets, and they say they verified a full infection chain against Al Jazeera's devices. ANSTO and government agencies: ANSTO says it has identified no impact on its facilities, systems or information as a result of the techniques described. Home Affairs referred the matter to the Australian Signals Directorate, which declined to comment. Critics and sceptics: No specific critic is named in the reporting, but the case raises questions about how an advertising intermediary gained the trust of major platforms, whether exposure equals infection (the researchers noted viewing an ad alone did not guarantee a device was compromised), and who is responsible for policing digital advertising supply chains.

What to Watch

Whether Google or other advertising platforms say more about what they changed and how they will vet future ad buyers.
Whether the Australian Signals Directorate or other agencies release any findings about affected Australian networks.
Whether Discover-Tech or its clients are identified further, and whether regulators or law enforcement act on the allegations.

Sources

Israeli company weaponised online advertising to track millions of devices · Just In

Checked

12 claims in this story checked against 1 source: 10 supported.

Show each claim

Partly supportedHeadline: researchers expose a spyware campaign that weaponised online ads against millions of devices.Just In: “secretly weaponised online advertising to track millions of devices and install spyware on some systems”
Partly supportedOpening: an Israel-based company secretly weaponised online advertising to profile millions of devices and install spyware, with Australian government agencies, critical infrastructure and ANSTO among the targets.Just In: “secretly weaponised online advertising to track millions of devices and install spyware on some systems”
SupportedSummary: the Australian nuclear agency is among targets in what the Citizen Lab calls an unprecedented attack.Just In: “It said millions of devices were targeted in the unprecedented attack, including those on networks belonging to Australian Nuclear Science and Technology Organisation (ANSTO)”
SupportedANSTO spokesperson: 'We are following standard response processes and have not identified any impact to our facilities, systems, and information from the techniques described in the reports.'Just In: “We are following standard response processes and have not identified any impact to our facilities, systems, and information from the techniques described in the reports," they said.”
SupportedHarkin: 'This is a demonstration of how the online advertising industry is not only being used to surveil, but also is being exploited for what looks like espionage.'Just In: “This is a demonstration of how the online advertising industry is not only being used to surveil, but also is being exploited for what looks like espionage," he said.”
SupportedThe Citizen Lab verified that devices belonging to Al Jazeera moved from viewing an infected ad to contact with Candiru servers, to files being installed.Just In: “The Citizen Lab verified that bad actors were able to use these advertisements to infect devices belonging to international news network Al Jazeera.”
SupportedGoogle removed Discover-Tech from its platform after the findings were shared.Just In: “The Citizen Lab report said Google removed Discover-Tech from its platform once the researchers had shared their findings.”
SupportedCandiru is under US export controls for its 'malicious cyber activities'.Just In: “At least one of those, Candiru, has been placed under US export controls because of its "malicious cyber activities".”
SupportedThe Department of Home Affairs directed inquiries to the Australian Signals Directorate, which declined to comment.Just In: “The Department for Home Affairs directed the ABC's inquiries to Australia's cyber intelligence agency, the Australian Signals Directorate, which declined to comment.”
SupportedDiscover-Tech bid in online advertising auctions to show ads on Duolingo, the BBC and the New York Times.Just In: “Discover-Tech "bid" against other prospective advertisers to show ads on websites and apps like Duolingo, the BBC and New York Times.”
SupportedMerely viewing an ad did not guarantee infection; it only meant a device had been exposed to the exploit.Just In: “Merely viewing the ad didn't guarantee the devices were successfully infected, only that it had been exposed to the exploit.”
SupportedThe report did not name most Australian targets; it highlighted a 'substantial cluster' of impressions in Australian critical infrastructure, government, university and media networks.Just In: “The report does not specify most of these, however it does say many Australian targets were working on nuclear research, and named the ANSTO and its Australian Synchrotron research campus.”