An Israeli advertising company, Discover-Tech, is accused of using online advertising auctions to track people whose devices connect through SpaceX’s Starlink satellite internet service, Reuters reported on 27 October 2026. Six people familiar with the research told Reuters that Discover-Tech is the company behind an operation that TrendAI, a unit of Japanese IT security firm Trend Micro, published on 15 October under the codename SHADOW-EARTH-79.
Key facts
- TrendAI found the operation won 12.9% of the Starlink advertising impressions it observed, against a 2.6% share of overall ad traffic, according to CyberSecurityNews.
- Researchers examined traffic tied to Starlink’s network identifier, AS14593.
- Google, Comcast and other companies told Reuters they removed Discover-Tech from their advertising platforms after the investigations.
- SpaceX, Discover-Tech and its chief executive did not respond to Reuters’ requests for comment.
Why it matters
CyberSecurityNews writes that the findings raise concerns about how routine advertising systems can expose people in sensitive locations, and that Starlink’s role in conflict zones makes such exposure serious for anyone whose position could put them at risk. heise online adds that intelligence agencies have a harder time monitoring and infiltrating Starlink connections than conventional networks.
Those conflict-zone users include Ukraine’s military, where, as we reported this month, Ukraine’s front-line units lost service for 10 days.
Who bought the most Starlink ads
TrendAI identified Steelhouse as the largest buyer of ad space served to Starlink-connected devices, placing more than 38% of all such ads during a 90-day observation period, heise online reports. Steelhouse was the name of an ad tech company that became part of MNTN, which like SpaceX is based in Texas. heise online says it asked MNTN for comment.
Discover-Tech came second on 12.9%. heise online notes the contrast in intensity: the Israeli company’s Starlink share was almost five times its share of general ad traffic, while Steelhouse’s was 2.2 times its general share.
How the tracking is said to work
Both reports describe real-time bidding, the automated auctions that decide which advertisement appears in a website or app. CyberSecurityNews says bidders can receive device information during these auctions, including IP addresses, network identifiers, advertising IDs and sometimes location data; heise online adds device type, screen resolution and the autonomous system number.
Combining network details with persistent advertising identifiers can help operators link activity across browsing sessions and build profiles without the user clicking anything, according to CyberSecurityNews. heise online reports TrendAI’s view that ads, and malware hidden in ads, can then be tailored accordingly.
Researchers also studied publicly available JavaScript bundles to reconstruct parts of the operation’s customer interface, identifying functions for de-anonymising users and manually inserting scripts. heise online quotes the report as saying those capabilities are “consistent with tools designed for surveillance and data collection”.
Where the bidding concentrated
Over a longer window running from June 2024 to June 2026, SHADOW-EARTH-79 was the leading buyer of Starlink-focused ads in 105 countries, heise online reports, winning nearly one in three placements on Starlink-connected devices in Germany — a pattern we covered in our report on how the Israeli firm led Starlink ad bidding in 105 countries.
Beyond Starlink, heise online says the operation was the largest buyer of online ad space overall in 49 countries, with a share above 90% in Hungary and Israel and between 61% and 78% in Egypt, Azerbaijan, Venezuela and Qatar. The target list includes sanctioned areas that Western advertisers generally have no interest in — Yemen, Libya, South Sudan, Syria and Venezuela — and CyberSecurityNews says the operation ranked first among observed ad buyers in Syria, Libya, Yemen and South Sudan.
What the sample does not cover
Those rankings describe what TrendAI saw through a single advertising buying platform, CyberSecurityNews cautions, rather than the whole advertising market, and the researchers warned that country estimates drawn from IP addresses carry uncertainty, flagging Myanmar and Sudan in particular. That sampling limit is why no southern African market appears in either report’s named totals, and neither touches Starlink pricing or where the service can be bought — questions that in the region still turn on licensing conditions such as South Africa’s 30% rule.
What the researchers stop short of saying
The Citizen Lab at the University of Toronto reported in mid-October that advertising infrastructure is being used systematically to carry out spyware attacks, which it calls “AdFection”, and described Discover-Tech as a key link between the advertising industry and vendors of government spyware, according to heise online. Citizen Lab and Confiant named Discover-Tech on 15 October, CyberSecurityNews says.
heise online notes that TrendAI’s report does not repeat the spyware allegation, because the data it collected is not suitable for reaching that conclusion. TrendAI said the bidding patterns and reconstructed software features suggested tracking infrastructure rather than normal commercial advertising, per CyberSecurityNews.
In several countries, heise online reports, the focus was not on Starlink users in general but on government agencies whose devices connect through Starlink, with the suspicion that the bidding was aimed at harvesting data rather than selling anything.
What TrendAI advises
TrendAI recommends restricting advertising traffic on sensitive devices, limiting permissions, disabling ad personalisation and reducing reliance on ad-supported apps, CyberSecurityNews reports. It warns that tools which merely hide advertisements may leave tracking requests active, and says defenders should favour controls that stop sensitive data reaching advertising systems in the first place.
Background
heise online recalls that in May the Israeli daily Haaretz reported that two Israeli companies, Targetteam and Rayzone, offer to locate and in some cases identify individual Starlink users. heise online says it has invited Discover-Tech to comment.
Frequently Asked Questions
Was Starlink’s network or its satellites hacked?
No — CyberSecurityNews says the allegations concern the misuse of advertising data, not a breach of Starlink’s satellites or network.
Does receiving one of these ads mean my device was infected?
No — CyberSecurityNews says receiving a Discover-Tech advertisement does not prove a device was infected.
Why did TrendAI not name Discover-Tech in its own report?
Five of Reuters’ sources said legal concerns led TrendAI executives to withhold the name, CyberSecurityNews reports, and heise online says TrendAI did not dispute the identification when Reuters put it to the company.
![Using Your Own Router with Starlink: Bypass Mode [2026]](https://starlink-news.com/wp-content/uploads/2026/09/using-your-own-router-with-starlink-bypass-mode-20-f6c09f95-120x86.png)
