Researchers Suspect Ad Firm Linked To Spyware Used Ad Auctions To Track Starlink Users

Digital security researchers suspect Israeli advertising technology firm Discover-Tech used online advertising auctions to help locate or monitor Starlink users. TrendAI's 15 October report found that an entity it called Shadow-Earth-79 was the leading bidder for Starlink-linked advertising in 105 countries. People familiar with TrendAI's research identified Shadow-Earth-79 as Discover-Tech.

The findings do not indicate that Discover-Tech breached SpaceX's satellite network. Instead, researchers suspect the company exploited real-time bidding, the automated system used to auction digital advertising space, to obtain information that could help locate or track users.

Bid requests can expose data such as IP addresses, device identifiers and location information. The unusual bidding patterns suggest possible surveillance, but do not establish that Discover-Tech successfully identified or monitored individual Starlink subscribers.

Ad Auctions May Have Exposed User Data

When websites or apps load, real-time bidding platforms send bid requests to potential advertisers. These requests can contain device information, browser details, IP addresses and location metadata.

Researchers said the unusually high volume of bids could have allowed data to be accumulated over time and used to profile or geolocate users. However, the findings do not establish that the company successfully identified individual Starlink subscribers or tracked their browsing activity.

Citizen Lab analysed Discover-Tech's bidding records from March to June 2026 and counted about 3.77 billion bids. The company's ads appeared on almost 200,000 websites and apps.

The records indicated spending of approximately $109,091 (£82,000) and no recorded conversions, although Citizen Lab noted that the system might not have reliably recorded conversion data.

Discover-Tech Led Starlink Bidding in 105 Countries

TrendAI found that Shadow-Earth-79 was the leading winning bidder on observed Starlink traffic in 105 countries.

The entity accounted for 12.9 per cent of winning bid events in the Starlink traffic TrendAI analysed, compared with 2.6 per cent of its overall advertising traffic. Its share of observed winning bids reached 91.3 per cent in Argentina, 89.1 per cent in the Philippines and 82.6 per cent in Japan.

In a separate analysis of broader advertising traffic, TrendAI found that Shadow-Earth-79 was the leading buyer of ads in Syria, Libya, Yemen and South Sudan, and the second-largest in Afghanistan. Researchers said the activity was difficult to explain through legitimate commercial demand in those markets.

Starlink terminals route internet traffic through satellites rather than state-run telecommunications networks. Researchers noted that the service is important to militaries such as Ukraine's, as well as journalists and citizens in restrictive countries such as Iran.

Citizen Lab Links Advertising Infrastructure to Spyware

Citizen Lab said Discover-Tech bought advertising space used to deliver zero-click spyware from Candiru, which has since been rebranded as Integrity Labs.

The organisation said the operation targeted at least 45 devices at Al Jazeera. According to its findings, devices that loaded the advertising scripts contacted Discover-Tech infrastructure before being routed to spyware validation servers within seconds.

Advertising containing the firm's scripts also appeared in networks associated with NATO, the European Parliament, the US Department of Defense, the International Atomic Energy Agency and the International Criminal Court.

Google terminated Discover-Tech's access to its advertising exchanges. Beeswax removed the company from its ad-buying platform, Eskimi blocked its accounts and domains, Vungle paused its access while conducting a review, and IAB Europe removed it from its vendor list.

At least one major US technology company and an international organisation have reportedly launched internal inquiries into whether their staff were targeted.