Israeli ad-tech company heavily targeted Starlink users, sources say

An Israeli advertising-technology company was heavily targeting users of SpaceX's Starlink satellite internet service in activity likely intended to geolocate or otherwise surveil them, according to six people familiar with the matter and research by TrendAI, a digital defense unit of Tokyo-based cybersecurity company Trend Micro, as reported by Reuters.

The findings do not establish that Discover-Tech carried out a completed spying operation, and they do not show that Starlink was breached. They describe suspicious activity in the digital advertising ecosystem, where bidders compete for space inside browsers and apps and may receive data about the people who view or interact with an ad.

Discover-Tech linked to Shadow-Earth-79

TrendAI researchers concluded that Discover-Tech was one of the world's leading bidders for ads aimed at Starlink users. They found it was the No. 1 bidder on Starlink traffic in more than 100 countries, including countries where Starlink was banned or restricted, according to the six sources. The researchers drew their conclusions from digital advertising data in TrendAI's telemetry.

TrendAI published a report on October 15 about the targeting of Starlink users but did not identify a company. It referred instead to an “ad tech entity” under the codename “Shadow-Earth-79.” The sources said that codename referred to Discover-Tech.

TrendAI did not directly answer questions about why the report did not name Discover-Tech. In a statement, it said its attribution approach was intended to reduce the risk of mistakes and avoid hype-driven labels or unstable actor names that could mislead defenders, distort risk prioritization or trigger inappropriate responses.

What the bidding activity showed

TrendAI's report described bidding patterns suggesting Shadow-Earth-79 was operating targeting and tracking infrastructure rather than conventional commercial advertising. It cited an obvious skew toward buying ads aimed at Starlink users.

The report said Shadow-Earth-79 was the top buyer of ads in Syria, Libya, Yemen and South Sudan, and the No. 2 buyer in Afghanistan. It said demand for legitimate Western advertising in sanctioned or active-conflict states was effectively zero. It also described an implausibly dominant share of bids in several countries, including Hungary, Israel, Egypt, Azerbaijan and Venezuela.

The advertising process can expose information about internet users to a bidder. Over time, bidders may collect that data, combine it with other information and use it to de-anonymize users, follow them around the web or target them with surveillance software. Those possibilities explain the scrutiny, but bidding patterns alone do not prove how Discover-Tech used any data it received.

Why Starlink traffic drew attention

Starlink terminals route data through SpaceX-operated satellites rather than nationally regulated telecommunications companies. That can allow users to sidestep local internet restrictions, communicate in hostile areas or coordinate activity across battlefields. The service has become important in Ukraine, where the military relies on it for frontline communications and directing drone strikes.

Tracking Starlink users has consequently drawn interest from governments and commercial operators. In May, Haaretz and Intelligence Online separately reported that Israeli-owned businesses were pitching clients on ways to identify and track Starlink users. Haaretz reported that advertising data appeared to play a key role.

Investigations and platform removals

On the day TrendAI published its Shadow-Earth-79 report, Canadian cyber watchdog Citizen Lab and New York ad-tech company Confiant identified Discover-Tech by name. Both said it abused the ad-bidding process, which can leak user data back to bidders.

Citizen Lab and Confiant said the ads had appeared inside dozens of sensitive networks belonging to media organizations, governments and technology companies. At least one large US technology company and one international organization also opened internal inquiries into whether Discover-Tech's ads had targeted their employees, according to people familiar with the matter.

Google, Comcast and other companies said they had removed Discover-Tech from their advertising platforms after the investigations. SpaceX did not respond to requests for comment. Discover-Tech and its chief executive also did not respond over a period of two weeks.

TrendAI researchers had discussed naming the company, according to the six sources, but dropped the idea after executives raised legal concerns, five sources said. Its report therefore used a codename while outside investigations named Discover-Tech. The evidence points to a potentially significant surveillance-related use of ad infrastructure, but intent and the precise use of collected data remain separate questions.

Sources

• Reuters: Alleged Israeli spy company heavily targeted Starlink users, sources say