Australian gov, media networks reached by Israeli firm’s spy ads

The national nuclear science agency, critical infrastructure operators and Australian government networks were among those reached by online ads that researchers say an Israeli company used to track devices and help plant spyware.

A report, Exposing Adfection, published by the University of Toronto's Citizen Lab said an Israeli firm, Discover-Tech (also spelt DiscoverTech) presented itself as a regular online advertising business.

Instead, it made use of online advertising and has links to companies that sell spyware to governments.

How the spy ads worked

When a website or app shows an ad, the space for it is usually auctioned off in less than a second.

Companies bidding for that space are sent details about the phone or computer that will display the ad.

This includes the device internet address and the tracking ID it uses for advertising, the internet address, which can reveal both the rough location for it, and which organisation's network a computer, phone or tablet connects to.

Discover-Tech’s Controlium control panel then let its customers single out targets using those tracking IDs or internet addresses, and limit campaigns to particular countries.

The winning ad is not just a picture, as its code can also carry small programs that run on the device while the ad is on-screen.

Discover-Tech's ads carried a program that contacted the company's servers whenever the ad loaded, reporting which device it was on.

For most devices, nothing further happened.

For selected targets, however, the servers sent back code that could lead to the device being infected, without the user clicking anything.

Even where no spyware was sent, Citizen Lab said each ad that appeared gave Discover-Tech information about the device.

"At minimum, we assess that these ad impressions would have resulted in profiling by Discover-Tech," the researchers said.

Australian networks in the data

The researchers said they found "a substantial cluster of impressions in Australia", including on government networks, networks linked to electricity grid and power companies, and university and research networks.

They named the Australian Nuclear Science and Technology Organisation and the Australian Synchrotron, which ANSTO operates.

The ads also appeared on the networks of three Australian media organisations, which the report did not name.

ANSTO says no impact found

ANSTO confirmed it was aware of the reports, including the reference to its Australian Synchrotron research campus.

"We are following standard response processes and have not identified any impact to our facilities, systems, and information from the techniques described in the reports," an ANSTO spokesperson said.

ANSTO did not say whether it blocks ads on staff devices or across its network, and added it does not publicly comment on detailed matters of its cyber security operations.

Citizen Lab was careful to say that an ad appearing on a network does not, on its own, show that anyone there was targeted or infected.

New York ad security firm Confiant, which published its own report in parallel, said the ads it linked to the sanctioned Candiru spyware were a tiny fraction of Discover-Tech's overall activity.

Australia was, however, not among the nine countries where it saw devices being handed over to Candiru's systems.

Even so, Citizen Lab said the ads' reach into sensitive networks called for urgent investigation, noting that its own data covered only part of Discover-Tech's activity over a limited period.

Global, large-scale operation

Between March and June this year, Discover-Tech bid to show ads 3.77 billion times and won about 442 million of those auctions, Citizen Lab found.

Ads carrying its tracking program appeared in 75,373 mobile apps and on 120,768 websites, including widely used apps such as Viber, Truecaller and Duolingo.

Confiant said Discover-Tech was serving at least 10 million ads a day around the world.

Beyond Australia, the ads reached networks belonging to NATO, the United Nations, the European Commission and dozens of government agencies.

ASD says to block ads

The Australian Signals Directorate's (ASD) Essential Eight security framework requires that web browsers do not display ads from the internet, even at its most basic level.

ASD's new Essentials framework, launched this month, treats ad blocking as one part of a broader principle on filtering internet content.

The security agency asks organisations to consider connections made by all their applications and services, not just browsers.

That wider view is important as about 76.7 per cent of Discover-Tech's bids were for ads inside mobile apps, where a browser ad blocker offers no protection.

Citizen Lab recommended that governments make ad blocking mandatory on their devices and networks, and switch off the advertising tracking IDs on government phones.

"The way online advertising works today is a systemic security threat," Wolfie Christl, a senior researcher at Citizen Lab, told Reuters.

Ad industry cuts ties

Google has since removed Discover-Tech from its advertising platforms, and industry body IAB Europe dropped the company from its list of approved vendors on 8 October.

Both had listed Discover-Tech as a certified or approved vendor since 2020.

Discover-Tech did not respond to requests for comment from Citizen Lab.

Citizen Lab said Discover-Tech's ads were used to deliver spyware from Israeli firm Candiru, which the US government blacklisted in 2021, to at least 45 devices at Qatari broadcaster Al Jazeera in 2024 and 2025.