Networks at Australia's national nuclear research agency were among those that displayed ads from an Israel-based firm that researchers say helped spyware vendors find and infect targets, ABC News (Australia) reported Monday. The agency says its systems were not breached, but the findings show that the ordinary online advertising pipeline reaches inside government science and critical-infrastructure organizations, which makes ad exposure an espionage risk that executives and security chiefs need to manage.
What Happened
The ABC report, by national AI reporter Cam Wilson, draws on data from the University of Toronto's Citizen Lab, which last week published "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware." The report found that Discover-Tech sat between ad platforms such as Google and spyware companies, including Candiru, which is under U.S. export controls. The Primary Wire covered the original findings Oct. 15.
According to the ABC, Discover-Tech bid for ad space on widely used sites and apps including Duolingo, the BBC and The New York Times. Code hidden in its ads could deliver "zero-click" spyware, malicious software that installs without the victim tapping or clicking anything, and could also profile devices to identify them, follow their web activity and estimate their location.
Citizen Lab's data records ad impressions, meaning occasions when one of these ads was displayed on a device connected to a given network. In a section on Australia, the report describes "a substantial cluster of impressions" on government networks, on networks tied to critical infrastructure such as grid and power companies, and on universities and research centers. Among the research sites it names are the Australian Nuclear Science and Technology Organisation (ANSTO) and its Australian Synchrotron research campus. The report also counts three Australian media organizations but does not name any specific Australian government agency. Outside Australia, impressions appeared among international defense forces, cyber agencies and organizations including NATO, the ABC said.
Exposure, Not Confirmed Compromise
An impression shows exposure to the exploit, not infection. The ABC noted that Citizen Lab verified infections only on devices belonging to Al Jazeera, the Qatar-based broadcaster. An ANSTO spokesperson told the ABC the agency had not identified any impact on its systems from the techniques described and that its systems had not been breached.
The Department of Home Affairs referred the ABC's questions to the Australian Signals Directorate (ASD), the government's signals intelligence and cybersecurity agency, which declined to comment. Google removed Discover-Tech from its platform after the researchers shared their findings, according to the report.
Why It Matters
Most security programs assume an attacker must persuade someone to click a link or open a file. In this scheme, simply displaying an ad was enough to start the process, so staff awareness training offers little protection. Diarmaid Harkin, a Deakin University associate professor who has researched the spyware industry, told the ABC the case shows the advertising industry being exploited not only for surveillance but for what looks like espionage, and questioned how the company won the trust of major ad players such as Google. "Who's acting as a watchdog for these digital advertising systems?" he asked.
The Australian data matters because of where the ads landed: nuclear research, power networks and government, the kinds of organizations whose information foreign intelligence services seek. For boards, that turns two routine decisions into security decisions. One is whether employee devices block ads and advertising identifiers, as Citizen Lab recommends. The other is how closely companies vet the ad-technology intermediaries they buy from or sell through.
The exposure is not limited to Australia. Citizen Lab's report cites research by ad-security firm Confiant that found the ads displayed on U.S. Department of Defense networks, and it lists impressions on networks of large U.S. technology, semiconductor and defense companies. The report cautions that some U.S. location data appeared to come from virtual private networks or server addresses.
What to Watch
Watch whether ASD or its partners in the Five Eyes intelligence alliance, which also includes the United States, Britain, Canada and New Zealand, issue guidance on threats delivered through ads. Also watch whether other organizations that appear in the data, named or unnamed, report the results of their own network checks, and whether Australian officials take up Harkin's call for closer oversight of the online advertising industry.
