Cybersecurity Researchers Link Israeli Ad Firm to Suspected Surveillance of Starlink Users Worldwide

An Israeli advertising technology company has been linked to an extensive operation targeting users of SpaceX's Starlink satellite internet service, according to a Reuters investigation and cybersecurity research that raises serious concerns about the use of online advertising systems for surveillance.

Reuters reported on October 27 that researchers at TrendAI, a cybersecurity unit of Trend Micro, identified unusually concentrated advertising activity aimed at Starlink connections in more than 100 countries.

The researchers tracked the activity under the designation SHADOW-EARTH-79. Six people familiar with the investigation told Reuters that the activity was attributed internally to Discover-Tech, an Israeli advertising technology company already named in separate spyware investigations.

TrendAI's published research did not identify Discover-Tech by name. That distinction is important because the company's attribution in the Starlink investigation rests on Reuters' source reporting rather than a direct public identification by TrendAI.

The researchers found that the suspicious advertising operation was the leading bidder for advertisements reaching Starlink traffic in 105 countries within the data they analysed.

It accounted for approximately 13 percent of observed winning Starlink advertising bids, substantially above the typical share recorded for other major bidders.

Researchers said the pattern was consistent with an operation designed to gather information about internet users rather than ordinary commercial advertising.

Real-time advertising auctions can expose information about devices and their connections, including internet addresses, device identifiers and potentially location-related data.

A company receiving enough of that information may be able to build profiles of users, follow their activity across websites and applications, or identify devices for more targeted surveillance.

The findings are particularly sensitive because Starlink provides internet connectivity in conflict zones and locations where conventional telecommunications infrastructure is damaged, restricted or unavailable.

The service is used for civilian communications and has also become important to Ukraine's military operations.

TrendAI identified unusually strong advertising activity in several countries affected by conflict or international restrictions, including Syria, Libya, Yemen and South Sudan.

However, evidence of targeted advertising does not establish that every Starlink user exposed to the operation was identified, hacked or infected with spyware.

The Starlink findings follow a separate investigation published on October 15 by Citizen Lab at the University of Toronto and advertising security company Confiant.

Those researchers linked Discover-Tech to the use of online advertisements for surveillance and the delivery of mercenary spyware.

Citizen Lab reported technical evidence connecting Discover-Tech advertisements to attacks involving Candiru spyware against devices used by employees of international broadcaster Al Jazeera.

The organisation said it identified at least 45 devices targeted during attacks in 2024 and 2025.

That documented spyware activity provides important context for the latest Starlink findings, but it does not independently prove that the same infection method successfully compromised Starlink users in the 105 countries identified by TrendAI.

Following the earlier investigations, Google and other advertising technology providers restricted or terminated Discover-Tech's access to their platforms.

Reuters said Discover-Tech, its chief executive and SpaceX did not respond to requests for comment on the latest findings.

The case exposes a broader weakness in the digital advertising industry.

Systems designed to match advertisements with potential customers can also reveal information useful to intelligence-gathering operations.

For journalists, humanitarian workers, military personnel, political activists and other people operating in sensitive environments, that information can carry substantial security risks.

The latest findings add urgency to calls for tighter controls on advertising data, stronger oversight of bidding platforms and improved protections for users whose locations or identities could make them targets.

The central unresolved questions are who ultimately used the information gathered through the suspected operation, whether specific Starlink users were compromised and how extensively the activity affected people outside the researchers' observed data.

Until those questions are answered, the investigation establishes a significant pattern of suspicious advertising activity and reported attribution to Discover-Tech, not a confirmed mass compromise of Starlink devices.