The Australian Broadcasting Corporation (ABC) has confirmed that a small number of staff devices were exposed to online advertisements associated with a sophisticated cyber espionage campaign. The incident was reported on 23 October 2026 after cybersecurity researchers identified a broader operation that allegedly exploited digital advertising systems to target sensitive organisations in Australia and other countries.

The campaign, known as Adfection, was investigated by researchers at Citizen Lab, a research group based at the University of Toronto. Their findings linked the activity to an Israel-based company called Discover-Tech, which allegedly used online advertising infrastructure to deliver malicious advertisements capable of collecting information about devices and, in some circumstances, installing spyware.

The technique raises concerns because online advertisements normally appear to be ordinary commercial content. Users may encounter them while browsing websites or using applications, without knowingly interacting with anything suspicious. Researchers said the reported operation could expose devices simply through the display of an advertisement, without requiring a person to click on it.

The ABC confirmed that advertisements from the identified network had appeared on a small number of staff devices. However, the broadcaster said its investigation had found no evidence that the exposure resulted in a successful compromise. It also reported no evidence that staff members had been identified or tracked through the incident.

As a precaution, the ABC began wiping affected devices that remained in service. The organisation said protecting employees, journalists and confidential sources was a priority.

The incident forms part of a wider campaign involving Australian organisations. Researchers identified a significant concentration of advertising activity associated with government networks, critical infrastructure and private-sector organisations. More than two dozen Australian organisations were reportedly part of the cluster, although their identities had not all been made public.

The Australian Nuclear Science and Technology Organisation (ANSTO) was among the organisations highlighted by researchers because of the volume of suspicious advertisements detected on its network. ANSTO said it had not identified any impact from the activity. The Australian Signals Directorate, the country's principal signals intelligence and cyber security agency, declined to comment on the investigation.

The researchers also linked the broader advertising technique to spyware used in other international cases. Their findings suggested that malicious advertisements could be used not only to attempt device infections but also to gather technical information that might help identify or profile users.

Cybersecurity specialists say the case demonstrates a weakness in the complex advertising ecosystem. Digital advertisements are distributed through networks of publishers, advertising exchanges and technology providers. Although these systems are designed to deliver relevant commercial content, their scale and complexity can make it difficult to identify every malicious participant before an advertisement reaches a user's device.

Journalists and media organisations are particularly sensitive potential targets because they may handle confidential sources, unpublished investigations and information about vulnerable people. Government agencies and critical infrastructure operators also hold information that could be valuable to hostile actors.

Greens digital-rights spokesperson David Shoebridge said the reported targeting raised questions about foreign interference and the regulation of online advertising technology. Researchers have not publicly established who, if anyone, commissioned the operation or what specific information the attackers sought from each Australian organisation.

The case highlights the need for organisations to monitor suspicious advertising activity, maintain updated security systems and investigate unusual behaviour on staff devices. It also raises broader questions about accountability for companies that supply advertising infrastructure used in cyber operations.

The ABC's response remains precautionary, and there is currently no confirmed evidence that its staff devices were successfully compromised. Investigations into the wider campaign continue, with the full extent of the targeting and the identities of all affected organisations still unclear.