> ## Content Index
> Fetch the complete content index at: https://www.bushletter.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Spyware-linked ads land on Australia's nuclear agency networks
- URL: https://www.bushletter.com/spyware-ads-from-israeli-firm-reached-ansto-networks/
- Published: 2026-10-19T21:30:00.000Z
- Updated: 2026-10-19T21:29:59.000Z
- Description: The same advertising pipeline infected Al Jazeera devices without a click. Australia's nuclear science agency says it has found no impact on its systems.
- Author: Bushletter Newsroom
- Tags: Technology, Cybersecurity, Australia

TLDR

Discover-Tech, an Israeli ad technology firm, won nearly 442 million ad auctions between March and June 2026, with impressions landing on networks belonging to ANSTO, the Australian Synchrotron and Australian media organisations. Citizen Lab confirmed for the first time that zero-click spyware can be delivered through ordinary display ads, with Al Jazeera devices infected via the same pipeline.

## How ordinary ads became a spyware delivery pipe

Discover-Tech, an Israeli advertising technology firm, used the standard real-time bidding system to place 441,954,291 winning ad impressions out of 3.77 billion auctions between March and June 2026, a win rate of 11.7 per cent, according to Citizen Lab's report 195 published on 15 October 2026.[\[1\]](https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/?ref=bushletter.com) Citizen Lab named the operation "AdFection".

Networks belonging to the Australian Nuclear Science and Technology Organisation (ANSTO), the Australian Synchrotron and several Australian media organisations all received impressions from the campaign.[\[1\]](https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/?ref=bushletter.com) Rendering the ad alone was sufficient for reconnaissance and, in confirmed cases, infection; no user click was required.

## First technical proof of zero-click spyware via ads

Devices at the international news network Al Jazeera were infected with Candiru mercenary spyware through Discover-Tech's targeted display advertisements, marking the first publicly documented case of zero-click spyware delivered through ordinary ad impressions.[\[1\]](https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/?ref=bushletter.com) Candiru is an Israeli commercial spyware developer.

Bill Marczak, Senior Researcher at Citizen Lab, said speculation about weaponised online ads had circulated for years without hard evidence. "There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action," Marczak said.[\[3\]](https://techcrunch.com/2026/10/15/citizen-lab-says-governments-are-abusing-online-ads-to-hack-people-with-zero-click-spyware/?ref=bushletter.com)

The real-time bidding architecture itself enables the mechanism. When a user loads a page, their device and browsing context are broadcast to multiple intermediaries in under a second, and third-party code can execute the moment an ad renders, without any action from the person viewing the page.[\[1\]](https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/?ref=bushletter.com)

## Confiant's takedown and the ANSTO response

Ad security firm Confiant found an unusual ad in April 2026 that triggered the investigation. Co-founders Louis-David Mangin and Jerome Dangu said the discovery reframed what the ad supply chain could be used for. "It all started in April when we found an unusual ad. We thought: if someone wanted to deliver a zero-day browser exploit to a device, this is how they'd do it," they said.[\[2\]](https://www.confiant.com/not-business-as-usual?ref=bushletter.com)

Confiant determined that Discover-Tech had abused advertising-based tracking, known as ADINT, to sell surveillance capabilities to spyware actors including Candiru, then led a coordinated takedown of Discover-Tech's access to the ad ecosystem.[\[2\]](https://www.confiant.com/not-business-as-usual?ref=bushletter.com)

An ANSTO spokesperson said it had not identified any impact to its systems as a result of the techniques Citizen Lab identified.[\[4\]](https://www.abc.net.au/news/2026-10-19/nuclear-agency-targeted-in-cyber-attack-infecting-devices/107283804?ref=bushletter.com)

## What Citizen Lab recommends

Citizen Lab recommends that organisations audit ad supply chain partners and restrict or monitor execution of third-party scripts within ads.[\[1\]](https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/?ref=bushletter.com)

Citizen Lab said existing laws and industry self-regulation "failed to catch or prevent" the attacks.[\[1\]](https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/?ref=bushletter.com)

KEY TAKEAWAYS

01Discover-Tech won 441,954,291 of 3.77 billion ad auctions from March to June 2026, an 11.7 per cent win rate.

02Al Jazeera devices were infected with Candiru spyware through display ads, the first confirmed zero-click ad infection.

03ANSTO said it had not identified any impact to its systems.

04Confiant found an unusual ad in April 2026 and led a coordinated takedown of Discover-Tech's ad ecosystem access.

05Citizen Lab said existing laws and industry self-regulation failed to catch or prevent the attacks.

SOURCES & CITATIONS

1. [Citizen Lab Report 195: Exposing AdFection, How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware](https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/?ref=bushletter.com)
2. [Confiant: Not Business as Usual](https://www.confiant.com/not-business-as-usual?ref=bushletter.com)
3. [Bill Marczak, Senior Researcher, Citizen Lab, statement on AdFection](https://techcrunch.com/2026/10/15/citizen-lab-says-governments-are-abusing-online-ads-to-hack-people-with-zero-click-spyware/?ref=bushletter.com)
4. [Nuclear agency among Australian networks reached by spyware ads, ABC News](https://www.abc.net.au/news/2026-10-19/nuclear-agency-targeted-in-cyber-attack-infecting-devices/107283804?ref=bushletter.com)

FREQUENTLY ASKED QUESTIONS

What is Discover-Tech?

Discover-Tech is an Israeli advertising technology firm whose MyDSP platform participated in real-time bidding auctions. Citizen Lab found the firm used ad supply chain access to facilitate targeted zero-click spyware installations on behalf of clients including Candiru.

Was ANSTO hacked?

An ANSTO spokesperson said it had not identified any impact to its systems as a result of the techniques Citizen Lab identified.

What is a zero-click spyware attack?

A zero-click attack infects a device without any action from the user. In the AdFection operation, simply loading a page that rendered a Discover-Tech ad was sufficient for reconnaissance or infection, with no click or download required.

What should publishers and IT teams do?

Citizen Lab recommends auditing demand-side and supply-side platform partners, implementing content security policies, and blocking inline JavaScript execution from unverified ad buyers.