Israeli ad firm linked to surveillance of Starlink users

Researchers at TrendAI, a cybersecurity unit of Trend Micro, have identified an Israeli advertising technology company as a primary source of digital ads shown to users of SpaceX's Starlink service. The firm, named Discover-Tech, appears to have used these advertisements to geolocate and surveil users, according to six individuals familiar with the matter. The findings suggest that the company leveraged the digital advertising ecosystem to track satellite internet subscribers on a global scale.

Analysis of digital advertising data indicated that Discover-Tech was among the world's leading bidders for ad space targeting Starlink users. The company ranked as the top bidder on Starlink traffic in more than 100 countries. This included several nations where Starlink is officially banned or restricted. Bidding in this context refers to the auction system advertisers use to secure placement within browsers and applications.

TrendAI released a detailed report on October 15 regarding the targeting of Starlink users. However, the report did not explicitly name Discover-Tech. Instead, the researchers referred to the entity as Shadow-Earth-79. Six sources confirmed that this codename refers to the Israeli company. TrendAI stated that its attribution strategy was designed to minimize errors and avoid labels that might mislead defenders or trigger inappropriate responses.

The ability to track Starlink users has become a significant focus for governments seeking to monitor the spread of satellite internet terminals. Because Starlink routes data through satellites operated by SpaceX rather than local telecommunications firms, it can bypass national internet restrictions. This capability is particularly valuable in conflict zones, such as Ukraine, where the military relies on the service for frontline communications and drone coordination.

Earlier this year, media outlets including Haaretz and Intelligence Online reported that Israeli businesses were marketing methods to identify and track Starlink users. These reports highlighted the role of ad data in the tracking process. On the same day TrendAI published its findings, the Canadian cyber watchdog Citizen Lab and the New York-based firm Confiant also named Discover-Tech. Both groups argued that the company abused the ad-bidding process to leak user data.

The leaked data could be collected and merged with other information to de-anonymize users and track their online movements. Citizen Lab and Confiant noted that these ads appeared within sensitive networks belonging to media organizations, governments, and technology firms. In response to these investigations, major companies including Google and Comcast removed Discover-Tech from their ad platforms. At least one major US tech company and one international organization have launched internal inquiries into potential employee targeting.

TrendAI’s report highlighted suspicious bidding patterns that suggested Shadow-Earth-79 was operating tracking infrastructure rather than a standard commercial advertising business. The entity was the top buyer of ads in Syria, Libya, Yemen, and South Sudan. It was also the second-largest ad buyer in Afghanistan, despite low demand for Western advertising in sanctioned or conflict-affected states. The company secured a dominant share of bids in countries such as Hungary, Israel, Egypt, Azerbaijan, and Venezuela.

TrendAI researchers were confident in their identification of Discover-Tech but initially decided not to name the company in the public report. Executives raised legal concerns that led to the decision to use a codename. This practice of self-censorship is not uncommon in the cybersecurity industry, where firms may fear retribution for exposing surveillance operations. A similar situation occurred earlier this year when Palo Alto Networks removed explicit references to China from a report on a cyberespionage campaign.

Palo Alto Networks stated that the lack of attribution in its report was not linked to procurement regulations in China, though the company’s operations in the region were under scrutiny at the time. Discover-Tech and its chief executive did not respond to requests for comment over the past two weeks. SpaceX also did not respond to requests for comment regarding the findings.

The incident highlights the growing complexity of digital privacy in an era of satellite internet. As more users rely on non-traditional networks, the potential for data leakage through advertising mechanisms becomes a critical concern for both private users and state actors. The coordinated response from various watchdogs and tech firms underscores the broader impact of these surveillance techniques on global digital infrastructure.