Researchers Say Israeli Ad Firm Targeted Starlink Users Worldwide
An Israeli advertising-technology company already implicated in a sprawling spyware pipeline became the leading bidder for ads shown to Starlink users across more than 100 countries, according to cybersecurity researchers. The pattern points to a surveillance operation built not by breaking into SpaceX satellites, but by exploiting the commercial machinery that follows people across the web.
Reuters reported the findings on October 27 after speaking with six people familiar with research by TrendAI, a unit of Trend Micro. Those sources identified Discover-Tech as the company behind an entity TrendAI called “Shadow-Earth-79.” The researchers found that it concentrated bids on Starlink traffic, including in countries where the satellite service is banned or restricted.
Discover-Tech and its chief executive did not respond to Reuters’ requests for comment. SpaceX also did not respond. That silence does not itself prove the attribution. But the Starlink pattern lands beside a separate body of technical evidence that has already exposed Discover-Tech’s place inside the mercenary-surveillance industry.
Advertising Became Intelligence Infrastructure
Every time an ad loads, an automated auction can reveal an internet address, approximate location and device identifiers to potential buyers. A bidder does not need to win every auction to learn from the stream. It can collect fragments, connect them over time and build a map of where a device travels and what its user reads.
TrendAI’s October 15 report did not publicly name Discover-Tech. It said Shadow-Earth-79 behaved like “targeting and tracking infrastructure rather than a commercial advertising operation.” The entity ranked first among observed buyers of Starlink traffic in more than 100 countries, the researchers found. It was also the top ad buyer in Syria, Libya, Yemen and South Sudan, and ranked second in Afghanistan—markets where ordinary Western advertising demand should be negligible.
The attribution to Discover-Tech comes from Reuters’ sources rather than TrendAI’s public report. Five sources said company executives removed the name after raising legal concerns. TrendAI told Reuters that its cautious attribution policy aimed to avoid mistakes and “hype-driven labels.”
That caution makes the independent investigations important. Citizen Lab and ad-security firm Confiant named Discover-Tech in reports released the same day. Citizen Lab analyzed four billion bidding records and found that the company’s ads appeared on almost 200,000 websites and mobile apps during a four-month period. The researchers said the firm’s systems could fingerprint devices, collect identifiers and decide whether to return additional code after an ad loaded.
Citizen Lab also documented a zero-click chain that infected 45 Windows devices at Al Jazeera between 2024 and 2025 with spyware linked to Candiru, an Israeli surveillance vendor blacklisted by the United States. Confiant separately traced Discover-Tech advertising to infrastructure attributed to Candiru. Both investigations stressed that an ad impression alone does not prove a device was infected, but it can expose a user to profiling and surveillance without any click.
The Market Built the Spyglass
The Starlink targeting matters because satellite internet has become critical infrastructure for people working around censorship, conflict and collapsed communications networks. The same feature that makes Starlink useful—its ability to bypass a national telecom system—also makes its users valuable targets for governments and private intelligence contractors.
This was not a niche operation hiding outside respectable commerce. Citizen Lab found Discover-Tech on approved-vendor lists maintained by Google and IAB Europe from 2020 until 2026. Its buying tools connected to major advertising platforms. Google, Comcast’s Beeswax, Eskimi and other companies removed or blocked the firm only after researchers presented their findings.
The lesson reaches far beyond one Israeli company. The advertising industry built an extraction system that identifies people, sorts them and sells access to their attention in milliseconds. Mercenary spyware vendors did not have to invent a new surveillance network. They rented the one already attached to nearly every commercial website and app.
Governments will promise oversight. Platforms will say they removed a bad actor. Neither response answers the structural problem: data collected for profit can be repurposed for political tracking, military intelligence and repression before a target sees so much as a banner ad.
The public record now supports two separate conclusions. Discover-Tech was technically linked to an advertising-based spyware pipeline, and TrendAI observed an extraordinary campaign against Starlink traffic. Reuters’ sources connect the two. Until Discover-Tech or SpaceX addresses those findings, users in conflict zones are left to assume that the browser on top of their satellite connection may reveal what the dish was supposed to protect.
Sources and image credits
Reuters — Alleged Israeli spy company heavily targeted Starlink users, sources say, October 27, 2026
Comments