Threat Intelligence · Privacy
Online ads used to track millions and infect devices with spyware
Researchers say an Israeli company used online ads to track millions of devices and install spyware on some, including systems linked to Australia's nuclear agency. The attack did not require users to click the ads.
Ross Grant3 min read
The short version
A report claims that an Israeli company used online ads to secretly track millions of devices and install spyware on some, including computers linked to Australia's nuclear agency. The attack did not require users to click on the ads, just viewing them could be enough. The nuclear agency says it has not found any sign that its systems were affected. Google has removed the company responsible from its advertising platform.
By the numbers
- millionsdevices targeted by weaponised adsABC News (Australia)
- 1Australian nuclear agency named as a targetABC News (Australia)
What happened?
Researchers say an Israeli company used online ads to track millions of devices and install spyware on some, including systems linked to Australia's nuclear agency. The attack did not require users to click the ads. ANSTO said it has not found any impact on its systems. Google removed the company behind the ads from its platform after being notified.
Who is affected
According to ABC News (Australia) (opens in a new tab), millions of devices worldwide were targeted by a campaign that weaponised online advertising. The affected networks included Australian government agencies, critical infrastructure, major media organisations, and specifically the Australian Nuclear Science and Technology Organisation (ANSTO) and its Synchrotron research campus. The Citizen Lab, a research group at the University of Toronto, also confirmed that international news network Al Jazeera's devices were infected. The report mentions that many Australian targets were involved in nuclear research.
How the attack worked
Researchers from The Citizen Lab found that a company called Discover-Tech used standard online advertising technology to deliver malicious code. Normally, online ads run small pieces of code in browsers and apps to display content. In this case, the code was weaponised: when a user simply viewed the ad (no click required), it could install spyware on the device. This type of attack is called a "zero-click" exploit, meaning it does not rely on the user interacting with the ad.
The ads were placed through normal advertising auctions on platforms like Google, appearing on popular sites such as Duolingo, the BBC, and the New York Times. When Discover-Tech won an auction, their ad would be shown to users, but hidden within it was code that could infect devices. The Citizen Lab traced the infection of Al Jazeera devices from viewing the ad, to contacting servers linked to spyware maker Candiru, to files being installed that hijacked the device.
What was taken
The spyware installed via these ads acted as a back door, giving attackers access to passwords, emails, and internal system details. Even if a device was not infected, the ad technology was used to profile devices: tracking web activity, identifying geographical location, and sometimes revealing a person's name or workplace. This profiling helped attackers select targets for further attacks.
The response
ANSTO said it was aware of the reports but had not found any impact on its systems. The Department for Home Affairs referred questions to the Australian Signals Directorate, which declined to comment. Google removed Discover-Tech from its advertising platform after being informed by The Citizen Lab. Researchers and experts called for greater oversight of the online advertising industry, warning that its scale and reach make it attractive for espionage and surveillance.
What you should do
Security professionals should review how online ads are delivered within their networks and consider blocking or monitoring ad traffic, especially on sensitive systems. Users and organisations should keep browsers and devices updated to reduce exposure to known exploits. Regulators and industry leaders are being urged to strengthen oversight of digital advertising platforms to prevent similar abuses.
Claimed vs confirmed
- Unconfirmed
An Israeli company used online ads to track millions and install spyware on some devices.
Reported by ABC News (Australia) citing The Citizen Lab; not confirmed by authorities or the affected organisations.
- Denied
ANSTO's systems were breached.
ANSTO said it had not identified any impact to its systems from the reported techniques.
Why it matters
This case shows how online advertising can be abused to deliver spyware and track people without any user action. Sensitive organisations, including those working on nuclear research, were among the targets. It raises questions about the security of digital ad platforms and the need for better oversight.
Key points
- Millions of devices were targeted through weaponised online ads.
- Some ads could install spyware without any user click (zero-click).
- Australian nuclear research networks and media were among the targets.
- Google removed the company behind the ads after being notified.
- Security experts urge more oversight of the online advertising industry.
Sources
ABC News (Australia)
Reference
