Suspected Surveillance Through Ad Auctions
Discover-Tech, an Israeli advertising technology company, has reportedly been linked to a suspected surveillance effort aimed at Starlink users, according to Reuters. The report, which cites six people familiar with the matter, claims the firm was the top bidder for ad space tied to Starlink traffic in more than 100 countries. Researchers suspect the aggressive bidding was meant to reveal where users are located or to enable further monitoring, though the findings do not show that anyone was actually tracked.
The data comes from TrendAI, the research arm of Trend Micro. Its October 15 report referred to the activity as Shadow-Earth-79 without naming a company, but the report claims the codename belongs to Discover-Tech. TrendAI says its attribution process is designed to avoid hype-driven labels that could mislead security teams.
How Real-Time Bidding Exploitation Works
The method exploits how online ads are sold with advertisers bidding in real-time auctions for space on websites and in apps, and each bid request can carry details about the person on the other end. Collected over time and combined with other data, that information could be used to identify people, follow their activity across the web, or select targets for spyware.
The geography is what raised eyebrows. Shadow-Earth-79 was reportedly the largest ad buyer in Syria, Libya, Yemen, and South Sudan, and the second largest in Afghanistan, while also claiming unusually large shares of bids in Hungary, Israel, Egypt, Azerbaijan, and Venezuela. TrendAI says the pattern points to targeting and tracking infrastructure rather than a commercial advertising operation.
Broader Scrutiny and Industry Response
Notably, Discover-Tech was already under scrutiny. On the same day as TrendAI’s report, Citizen Lab and ad security firm Confiant separately named the company, alleging that it used ad auctions to collect data on users across sensitive networks, including those tied to media organizations, governments, and tech firms.
Google and Comcast have since said they removed Discover-Tech from their advertising platforms, while the report says that a major U.S. technology company and an international organization have opened internal inquiries into whether the firm’s ads targeted their employees.
Starlink Resilience in Conflict Zones
For Starlink, the stakes are obvious as the service works outside conventional telecom networks, making it a lifeline where governments restrict internet access and an attractive target for those same authorities. In April, Iran’s nationwide internet blackout passed 1,000 hours, with authorities reportedly going after Starlink terminals and imposing severe penalties for possessing one.
Advertising and consumer tech have been abused for tracking before. A backdoor was previously found in a popular iOS ad library that could collect device-location data and capture screenshots, while Android spyware linked to the Pegasus family was discovered on a small number of devices.
It remains unclear if Discover-Tech actually used Starlink-related data to single out specific subscribers, and neither the company nor SpaceX has commented on the findings.
