Israeli advertising technology company Discover-Tech is accused of using online advertising auctions to track people connected to SpaceX’s Starlink satellite internet service across more than 100 countries, according to CyberSecurityNews, which cited a Reuters report published on 27 October 2026. The same account sets out what the researchers behind the work say Starlink users in sensitive locations should actually do about it.
The underlying research was published on 15 October by TrendAI, a unit of the security company Trend Micro, under the codename SHADOW-EARTH-79. The Business Standard described it as a TrendAI cybersecurity investigation that identified suspicious bidding activity which could expose user data and enable surveillance.
Key facts
- Six people familiar with the research told Reuters that TrendAI researchers linked Discover-Tech to unusually heavy advertising activity aimed at Starlink users, in the 27 October report relayed by CyberSecurityNews.
- TrendAI’s public report, issued 15 October, did not identify Discover-Tech; Reuters’ sources said the codename SHADOW-EARTH-79 referred to the Israeli company.
- Citizen Lab, a cybersecurity watchdog, and Confiant, an ad-tech firm, named Discover-Tech publicly on 15 October, both outlets reported.
- Google, Comcast and other companies said they removed the company from their advertising systems after the investigations, per Reuters as reported by CyberSecurityNews.
Why it matters
The findings raise concerns about how routine advertising systems can expose people in sensitive locations, CyberSecurityNews said, and Starlink’s role in conflict zones makes that exposure serious for anyone whose location could put them at risk. The Business Standard framed the research the same way — as a question about digital advertising auctions, online privacy and the potential tracking of Starlink users in conflict zones.
The country detail is specific rather than general. The operation ranked first among observed ad buyers in Syria, Libya, Yemen and South Sudan, the outlet reported, and two of those four markets — Libya and South Sudan — are African, which is what makes the finding more than a distant security story for readers on the continent.
Neither outlet quantifies how many Starlink users are in those markets, so the size of any exposed population in Libya or South Sudan is unreported. What the ranking establishes is concentration, not headcount.
What TrendAI tells users to do
The recommendations are aimed at devices that matter, not at every subscriber. TrendAI advises restricting advertising traffic on sensitive devices, limiting app permissions, disabling ad personalisation and reducing reliance on ad-supported apps, per CyberSecurityNews.
Does this change Starlink pricing or availability?
Not on the evidence published so far. Neither CyberSecurityNews nor The Business Standard reports any change to Starlink pricing, hardware, coverage or licensing arising from the investigation, and the TrendAI guidance is device-level: nothing in it asks a user to change a plan or service tier.
The reporting also carries no pricing figures for the four markets at the centre of the finding, and neither outlet says whether SpaceX sells residential service in each of them. The authoritative source on that remains SpaceX’s own availability map, which publishes country-by-country service status and monthly rates in local currency; our Starlink pricing and availability by country guide tracks the same figures. We will report separately if regulators or SpaceX tie these allegations to service terms in any country.
How the alleged tracking is said to work
The suspected tracking relies on real-time bidding, the automated auctions that decide which advertisements appear inside websites and apps. During those auctions, bidders can receive device information including IP addresses, network identifiers, advertising IDs and sometimes location data, CyberSecurityNews reported.
Researchers examined traffic associated with Starlink’s network identifier, AS14593. Combining network details with persistent advertising identifiers can help operators link activity across browsing sessions and build profiles of users without requiring them to click an advertisement, per the report.
Reconstructing the interface
TrendAI’s researchers also studied publicly available JavaScript bundles to reconstruct parts of the operation’s customer interface, the outlet said. They identified functions linked to identifying users behind anonymous identifiers and to manually inserting scripts — features the report described as consistent with intelligence gathering. TrendAI said those patterns, alongside the reconstructed software features, suggested tracking infrastructure rather than normal commercial advertising.
What the numbers do and do not show
TrendAI found SHADOW-EARTH-79 was the leading winning bidder for Starlink ad traffic in 105 countries that it observed. In a separate comparison it received 12.9% of Starlink ad impressions against a 2.6% share across overall traffic, which CyberSecurityNews said shows a strong focus on satellite internet users.
Those figures come with caveats stated in the research itself: they describe TrendAI’s sample rather than the entire advertising market, the study relied on data from one advertising buying platform, and researchers warned country estimates based on IP addresses carry uncertainty, including differences involving Myanmar and Sudan. The report also does not establish that every exposed Starlink user was tracked or infected.
Who named the company — and who held back
There is a gap between the technical report and the reporting around it. TrendAI’s public report did not identify Discover-Tech; Reuters’ sources tied the codename to the Israeli company, and five of them said legal concerns led executives to withhold the name. Citizen Lab and Confiant named the firm separately on the same day, which is how the accusation first became public.
One point on the attribution chain: the unnamed-source lines above — the six people familiar with the research and the five sources on the legal concerns — are Reuters’ own sourcing, relayed here as CyberSecurityNews reported it. They are not TrendAI statements, and none of the individuals is quoted directly in either outlet.
CyberSecurityNews also noted that its earlier coverage of a compromise of the Adform advertising platform involved malicious scripts and was a separate incident, not evidence of the Starlink-focused operation described here.
Frequently Asked Questions
Does this mean Starlink’s satellites or network were hacked?
No. The allegations concern the misuse of advertising data, not a confirmed breach of Starlink’s satellites or network, according to CyberSecurityNews. The data in question is said to flow through routine ad auctions, not through SpaceX systems.
If a Discover-Tech advertisement reached my device, was it infected?
Not necessarily. CyberSecurityNews, which previously reported on Citizen Lab and Confiant findings about zero-click spyware delivered through online ads, stressed that receiving a Discover-Tech advertisement does not prove a device was infected.
Will an ad blocker stop this kind of tracking?
TrendAI warned that tools which merely hide advertisements may leave tracking requests active, per CyberSecurityNews. The researchers said defenders should instead favour controls that stop sensitive data reaching advertising systems in the first place.
Have SpaceX and Discover-Tech commented?
No. CyberSecurityNews, citing Reuters, reported that SpaceX, Discover-Tech and the company’s chief executive did not respond to Reuters’ requests for comment.
![Using Your Own Router with Starlink: Bypass Mode [2026]](https://starlink-news.com/wp-content/uploads/2026/09/using-your-own-router-with-starlink-bypass-mode-20-f6c09f95-120x86.png)
