Reuters reported on Tuesday, 27 October, that Discover-Tech, an Israeli advertising firm, was the leading buyer of digital advertising shown to users of SpaceX’s Starlink satellite internet service, citing six people familiar with the research behind the finding. Those people said researchers believed the ads were being used to geolocate or otherwise surveil Starlink users, according to Gizmodo, which reported on the Reuters story and the underlying research.
The research came from TrendAI, a unit of Tokyo-based cybersecurity company Trend Micro, and from Citizen Lab, the digital rights research group at the University of Toronto, as reported by The News International.
Discover-Tech took about 12.9% of winning advertisements in the Starlink sample, against a 2.6% baseline across general traffic — a nearly fivefold over-representation and the highest lift of any high-volume buyer. It spent roughly $109,000 over four months and recorded no conversions, per the TrendAI figures cited by Gizmodo.
Key facts
- Discover-Tech was the No. 1 winning bidder for advertising impressions on Starlink traffic in 105 countries, per the TrendAI data cited by Gizmodo. The News International puts the figure at more than 100 countries.
- TrendAI used the codename SHADOW-EARTH-79 for the entity in an analysis published on 15 October; sources told Reuters the codename referred to Discover-Tech.
- Analysis of roughly four billion bidding records from March to June 2026 showed about 3.77 billion bids placed and roughly 442 million auctions won, with script tags appearing across 75,373 Android and iOS apps and 120,768 websites, Gizmodo reports.
- Google cut off the firm’s access to its ad exchanges, and IAB Europe removed it from its Global Vendor List on 8 October.
Why it matters
Satellite internet bypasses national telecom regulation and local blocks, which is why governments are looking for ways to track Starlink users, The News International reports. Several of the countries where the bidding skew showed up restrict or prohibit the service, meaning the people who reach it are doing so where Starlink availability is politically sensitive or subject to government scrutiny, according to Gizmodo.
Gizmodo also notes the mechanism involved does not require breaking into Starlink itself: real-time bidding shares detailed device and location data with every participating buyer, which provides a ready route to tracking. The News International describes the same process as leaking user data back to bidders, where repeated collection and merging of that data can de-anonymise users, follow them online and set them up for spyware delivery.
Where the skew was strongest
TrendAI found the pattern concentrated in specific markets, Gizmodo reports: 91.3% of observed Starlink wins in Argentina, 89.1% in the Philippines and 82.6% in Japan. The buyer was also the top bidder in Syria, Libya, Yemen and South Sudan, and the No. 2 bidder in Afghanistan — markets where TrendAI said demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero. Similar dominance appeared in Hungary, Israel, Egypt, Azerbaijan and Venezuela.
TrendAI concluded with moderate-to-high confidence that the bidding was consistent with “targeting and tracking infrastructure rather than a commercial advertising operation,” in the words quoted by Gizmodo.
Read against that list, the legal status of the service starts to look like a risk variable in its own right: the skew clusters where Starlink is banned, sanctioned or fought over, not where it is licensed and sold openly — the position being negotiated in markets such as South Africa, where access turns on South Africa’s 30% ownership rule.
The spyware link
Citizen Lab named Discover-Tech in a 15 October report as the buyer of ordinary-looking ads that delivered Candiru spyware to devices at Al Jazeera without any user interaction, Gizmodo reports. Candiru is an Israeli mercenary spyware vendor, now rebranded as Integrity Labs, whose tools can silently compromise phones and computers. The U.S. Department of Commerce’s Bureau of Industry and Security added Candiru to its Entity List trade restrictions in 2021 over concerns its technology was used against journalists, activists and government officials.
Citizen Lab said it identified at least 45 devices at Al Jazeera infected with Candiru spyware in 2024 and 2025, and used network logs to reconstruct a sequence in which devices contacted Discover-Tech infrastructure when ads loaded, followed within seconds by communications with a Candiru validation server, according to Gizmodo.
Citizen Lab also found that the firm presented itself as a legitimate advertising company and held certified or approved vendor status with Google and IAB Europe from 2020 until earlier this month, Gizmodo reports. Its ads reached networks associated with NATO, the European Parliament, the U.S. Department of Defense, the International Atomic Energy Agency and the International Criminal Court, according to Citizen Lab and a parallel investigation by ad security firm Confiant, as reported by Gizmodo. Exposure on that scale is the kind of question defence ministries have already begun putting to themselves: the UK is separately weighing how much it depends on Starlink and Starshield.
Background
John Scott-Railton, a senior researcher at Citizen Lab, wrote on X that the TrendAI data suggested a worldwide surveillance operation targeting Starlink users, Gizmodo reports. He also pointed to earlier reporting by the Israeli newspaper Haaretz on Israeli companies marketing tools to locate Starlink terminals and, in some cases, identify their users. The News International dates that reporting, by Haaretz and Intelligence Online, to May.
Gizmodo cites Iran as an example of the stakes: Starlink was among the tools used by Iranian citizens in January during anti-government protests, despite the authorities’ attempts to crack down on the service. The News International notes Starlink’s role in hostile environments and on battlefields, including Ukrainian military communications and drone strikes — reliance that is already proving brittle for other reasons, as in the dispute over Starlink speed caps on Ukraine’s front line.
What the reporting does not yet show
The identification of Discover-Tech rests on six unnamed people who described the research to Reuters; TrendAI itself published under a codename and has not named the company. Neither TrendAI’s underlying dataset nor the documents Reuters worked from have been released publicly, and this site has not reviewed them — the figures above come from Gizmodo’s and The News International’s accounts of that work. What the two investigations establish together, Gizmodo says, is that the same advertising infrastructure previously used to deliver Candiru spyware was the leading source of ads shown to Starlink users across more than 100 countries, including several where the service faces restrictions.
Frequently Asked Questions
Has anyone confirmed that Starlink terminals or routers were hacked?
No. Gizmodo states that researchers have not publicly confirmed infections of Starlink devices. The finding is about which company won the advertising auctions shown to Starlink users, not about a compromise of SpaceX’s own infrastructure.
Why did TrendAI not name Discover-Tech in its original report?
According to Reuters, as reported by Gizmodo, TrendAI had considered naming the company in its 15 October analysis but did not do so after executives raised legal concerns. People familiar with those discussions described the decision to Reuters.
Can Discover-Tech still buy ads on Google?
Gizmodo reports that Google told Citizen Lab it had blocked the firm from bidding or serving ads anywhere in Google’s ecosystem, not only on the exchanges it was removed from.
Is this the first time advertising has been linked to zero-click spyware?
Gizmodo reports that Citizen Lab described its earlier findings on Discover-Tech and Candiru as the first public technical confirmation of zero-click mercenary spyware delivered through targeted advertising.
![Using Your Own Router with Starlink: Bypass Mode [2026]](https://starlink-news.com/wp-content/uploads/2026/09/using-your-own-router-with-starlink-bypass-mode-20-f6c09f95-120x86.png)
