Israeli Ad Tech Firm Allegedly Targeted Starlink Users for Surveillance, Sources Say

An Israeli ad tech company has been heavily targeting users of SpaceX's Starlink satellite internet service through the digital advertising market in a likely effort to conduct surveillance, according to six people familiar with a recent cybersecurity investigation. The firm, identified by the sources as Discover-Tech, allegedly exploited the ad auction system to track and geolocate Starlink users globally.

Ad Bidding System Exploited

Researchers at TrendAI, a division of cybersecurity firm Trend Micro, concluded that an entity they codenamed "Shadow-Earth-79" was a dominant force in bidding for ad space shown to Starlink users. The six sources confirmed to Reuters that this codename refers to Discover-Tech. The method involves abusing the complex ad bidding process, which can leak data about internet users—such as their location and device information—back to the bidder.

Over time, this leaked data can be collected and combined with other information to de-anonymize users and track their online activity. In a report published on October 15, TrendAI described the entity's activity as resembling "targeting and tracking infrastructure rather than a commercial advertising operation." Separately, Canadian cyber watchdog Citizen Lab and ad tech firm Confiant also publicly named Discover-Tech in their own investigations into the abuse of the ad bidding process.

Widespread and Suspicious Targeting

The scale of the operation points to a non-commercial motive, according to the research. TrendAI found that Discover-Tech was the No. 1 bidder on ad traffic from Starlink users in more than 100 countries, including several where the service is banned or restricted.

Ad

The bidding patterns were particularly suspicious in conflict zones and sanctioned states where legitimate advertising demand is extremely low. According to the TrendAI report, the entity was:

• The top buyer of ads in Syria, Libya, Yemen, and South Sudan.
• The No. 2 ad buyer in Afghanistan.
• The winner of an "implausibly dominant share" of bids in countries including Hungary, Israel, Egypt, and Venezuela.

Industry Context and Response

The ability to track Starlink users has become a significant objective for state actors, as the satellite terminals can bypass national internet controls and provide crucial battlefield communications, as seen with Ukraine's military. The terminals route data through SpaceX satellites rather than locally regulated telecom infrastructure, making them difficult to monitor through traditional means.

In response to the investigations from Citizen Lab and Confiant, major ad platform operators including Google and Comcast have removed Discover-Tech from their systems. SpaceX and Discover-Tech did not respond to requests for comment on the matter, according to Reuters. TrendAI did not publicly name Discover-Tech in its report, with five sources stating that executives raised legal concerns, a practice of self-censorship that industry experts say is common when exposing potential state-linked surveillance operations.