A cybersecurity investigation has revealed that an Israeli advertising firm likely exploited Starlink satellite internet connections to monitor users across more than 100 countries, exposing potential surveillance risks within digital ad networks.
TrendAI, the cybersecurity arm of Trend Micro, discovered irregular advertising behavior tied to Starlink users in 105 nations. This activity, labeled as Shadow-Earth-79, represented roughly 13% of successful ad bids in their dataset—nearly five times its proportion of overall ad traffic. Six individuals familiar with the probe told Reuters the pattern strongly suggested involvement by Discover-Tech, an Israeli company previously implicated in surveillance through digital advertising.
Advertising auctions determine which ads appear on websites and applications, often exposing user details such as device information, IP addresses, and approximate locations. By compiling these details over time, an operator could track individuals without direct account access. TrendAI researchers noted the bidding behavior resembled surveillance tactics rather than conventional advertising practices.
Starlink, operated by SpaceX, delivers satellite-based internet access that has become essential in conflict zones and regions with restricted networks. Military forces in Ukraine and elsewhere rely on the service, while civilians use it to bypass local internet restrictions. Researchers found Shadow-Earth-79 dominated ad bidding in Syria, Libya, Yemen, and South Sudan, while holding significant shares in Hungary (91%), Israel (90%), Egypt (77%), and Azerbaijan (75%).
The investigation also detected Starlink-related ad activity in countries where the service faces regulatory challenges, including Cameroon, Syria, Sudan, Myanmar, and Libya. Though geolocation data is not always precise, the researchers cross-referenced findings with Starlink’s published network locations. Their analysis suggested the patterns indicated infrastructure designed for tracking rather than standard advertising.
Read Also: Musk warns of major AI cloud firm failures and consolidation
The findings do not confirm that specific users were identified or targeted with spyware, but they align with separate reports from the University of Toronto’s Citizen Lab and advertising security firm Confiant, both released on October 15. Citizen Lab found Discover-Tech’s ad systems had distributed spyware from Candiru, an Israeli firm blacklisted by the U.S. in 2021. The spyware infected 45 Windows devices used by Al Jazeera employees between 2024 and 2025 through a zero-click attack—one requiring no user interaction to deploy malware.
Following these reports, Google removed Discover-Tech from its ad vendor registries and blocked its access to ad exchanges in early October. Comcast’s ad technology unit, Beeswax, and other platforms also restricted the company’s operations. At least one major U.S. tech company and an international organization have since initiated internal reviews to determine whether their employees were exposed to Discover-Tech ads.
TrendAI initially planned to name Discover-Tech in its October 15 report but ultimately refrained after executives raised legal concerns, according to five sources. The researchers emphasized their approach prioritizes accuracy to avoid errors that could hinder cybersecurity investigations. Neither Discover-Tech nor SpaceX provided comments in response to requests.
Discover-Tech’s ad infrastructure has been tied to surveillance tools before. In 2021, the U.S. Commerce Department blacklisted Candiru, the firm behind the spyware used in the Al Jazeera breach.