Researchers Say Online Ads Were Weaponised to Track Millions of Devices, Including Australian Government Targets

Research group The Citizen Lab says it has found proof that an Israel-based company exploited digital advertising technology to install back doors on devices. The victim only had to view an advertisement on a website or in an app. Researchers said millions of devices were targeted, including those on networks belonging to the Australian Nuclear Science and Technology Organisation (ANSTO), other Australian government agencies, critical infrastructure operators and major media organisations. ANSTO said it had not identified any impact to its systems from the techniques described.

The Citizen Lab published its findings last week in a report titled "Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware". Deakin University associate professor Diarmaid Harkin, who has researched the spyware industry, explained that ordinary advertising technology runs a small amount of code in browsers and apps to display an ad. This time, he said, it was not innocent. The "zero-click" approach let attackers run code on devices and install software acting as a back door, giving access to things like passwords, emails and details of internal systems.

Dr Harkin described it as a novel case showing how bad actors use online infrastructure to compromise their opponents. He said it highlights the need for more oversight of the online advertising industry. The source material does not say whether small businesses were affected, but it shows that ordinary web and app advertising can become an attack path without any action from the user.