ABC targeted in spyware campaign

The ABC wiped a small number of staff devices exposed to malicious online ads. The broadcaster said it found no signs of compromise from the attack.

“There is no evidence of a resulting compromise.”

Campaign called Adfection targets dozens

Researchers at The Citizen Lab uncovered the operation, dubbed Adfection. More than two dozen Australian government, critical infrastructure, universities and media organisations were targeted.

Israeli company exploited ad networks

Company Discover-Tech exploited digital advertising technology from major platforms like Google to deliver spyware from Israeli company Candiru. Devices could be infected by viewing an ad without clicking.

Al Jazeera also infected with spyware

Researchers confirmed Discover-Tech's technique was used to infect devices at international news network Al Jazeera with spyware from Candiru, an Israeli company.

Attack profiles millions of devices

Even unsuccessful infections allowed attackers to profile tens of millions of devices shown malicious advertisements, potentially revealing their identities and online habits through measured impressions.

Advertising system has known vulnerabilities

University of Queensland Professor Nicholas Carah said the attack proves online advertising is useful infrastructure for exploitation. Bad actors can exploit existing characteristics to thwart tracking protections.

“You can get an internet protocol address, or a mobile, then, hey, presto, you're able to identify those individuals.”

Greens raise foreign interference concerns

Greens leader David Shoebridge said targeting the ABC and sensitive government agencies raises serious questions about foreign interference and shows need for privacy reform and digital duty of care.

“When foreign zero-click adtech is aimed at our public broadcaster, and other sensitive government agencies, that of course raises serious questions about foreign interference.”

ANSTO targeted, others unidentified

Australia's nuclear science agency ANSTO was singled out as a hotspot for malicious ads. Citizen Lab researchers did not identify the other targeted organisations or who carried out the attacks.