ABC wipes staff devices after Citizen Lab report links ads to zero-click spyware campaign

ABC has wiped a small number of staff devices after it was told they were exposed to malicious online advertising connected to a spyware campaign, according to a report by Citizen Lab published in October 2026. ABC said it has found “no signs of compromise” and that it is wiping any affected devices that remain in service. [ABC’s report]

The campaign, researchers say, is part of what Citizen Lab calls “AdFection” and involves targeted ads that can infect devices without a user clicking on the advertisement. Citizen Lab’s technical analysis attributes the approach to an Israeli adtech operation linked to “Discover-Tech” and describes how ads can deliver spyware simply through rendering. [Citizen Lab: Exposing AdFection]

ABC says its own review found that ads were shown on a small number of its devices, with “no evidence” staff members were identified or tracked from the exposure. The broadcaster also described the wipe as precautionary, while it continues to assess impacts related to staff privacy and protections for journalistic sources. [ABC statement]

Citizen Lab reports that Australia forms part of a broader “significant cluster” of targets, and that researchers observed malicious ad impressions reaching government, critical infrastructure, universities and media organisations. ABC reported that more than two dozen other Australian organisations may be implicated, but their identities have not yet been publicly identified.

The Citizen Lab findings also align with longstanding warnings from press-freedom groups about the growing risk of spyware directed at journalists. Reporters Without Borders’ digital-security resources note that spyware against journalists is “on the rise” and emphasise that digital attacks can be difficult to detect without specialist checks. [Reporters Without Borders on spyware risks]