Spyware-linked ads land on Australia's nuclear agency networks

How ordinary ads became a spyware delivery pipe

Discover-Tech, an Israeli advertising technology firm, used the standard real-time bidding system to place 441,954,291 winning ad impressions out of 3.77 billion auctions between March and June 2026, a win rate of 11.7 per cent, according to Citizen Lab's report 195 published on 15 October 2026.^[1] Citizen Lab named the operation "AdFection".

Networks belonging to the Australian Nuclear Science and Technology Organisation (ANSTO), the Australian Synchrotron and several Australian media organisations all received impressions from the campaign.^[1] Rendering the ad alone was sufficient for reconnaissance and, in confirmed cases, infection; no user click was required.

First technical proof of zero-click spyware via ads

Devices at the international news network Al Jazeera were infected with Candiru mercenary spyware through Discover-Tech's targeted display advertisements, marking the first publicly documented case of zero-click spyware delivered through ordinary ad impressions.^[1] Candiru is an Israeli commercial spyware developer.

Bill Marczak, Senior Researcher at Citizen Lab, said speculation about weaponised online ads had circulated for years without hard evidence. "There has been a lot of buzz that online ads can be used to identify and automatically hack targets with pinpoint precision, but now for the first time, we have concrete technical evidence showing this process in action," Marczak said.^[3]

The real-time bidding architecture itself enables the mechanism. When a user loads a page, their device and browsing context are broadcast to multiple intermediaries in under a second, and third-party code can execute the moment an ad renders, without any action from the person viewing the page.^[1]

Confiant's takedown and the ANSTO response

Ad security firm Confiant found an unusual ad in April 2026 that triggered the investigation. Co-founders Louis-David Mangin and Jerome Dangu said the discovery reframed what the ad supply chain could be used for. "It all started in April when we found an unusual ad. We thought: if someone wanted to deliver a zero-day browser exploit to a device, this is how they'd do it," they said.^[2]

Confiant determined that Discover-Tech had abused advertising-based tracking, known as ADINT, to sell surveillance capabilities to spyware actors including Candiru, then led a coordinated takedown of Discover-Tech's access to the ad ecosystem.^[2]

An ANSTO spokesperson said it had not identified any impact to its systems as a result of the techniques Citizen Lab identified.^[4]

What Citizen Lab recommends

Citizen Lab recommends that organisations audit ad supply chain partners and restrict or monitor execution of third-party scripts within ads.^[1]

Citizen Lab said existing laws and industry self-regulation "failed to catch or prevent" the attacks.^[1]