Australia's nuclear science agency and other highly sensitive government organisations have been targeted by a sophisticated, foreign bad actor that secretly weaponised online ads to install spyware.