Discover-Tech, an Israeli advertising firm previously linked to the delivery of zero-click spyware, is the top bidder for Starlink ad impressions in 105 countries, according to a new report from Reuters. Researchers say it all points to a large-scale tracking effort aimed at users of SpaceX\u2019s satellite internet service.<\/p>\n
John Scott-Railton, a senior researcher at the University of Toronto\u2019s Citizen Lab, posted<\/a> on X that data from TrendAI suggest the existence of a \u201cworldwide surveillance op targeting @Starlink users.\u201d<\/p>\n Discover-Tech was previously named in Citizen Lab\u2019s October 15th report<\/a> as the buyer of ordinary-looking ads that delivered Candiru spyware to devices at Al Jazeera without any user interaction. Candiru is an Israeli mercenary spyware vendor (now rebranded as Integrity Labs) that develops tools capable of silently compromising phones and computers. In 2021, the U.S. Department of Commerce\u2019s Bureau of Industry and Security added Candiru to their trade restriction list, known as the Entity List<\/a>, over concerns it supplied surveillance technology used against journalists, activists, and government officials.<\/p>\n Citizen Lab\u2019s initial report on Discover-Tech and Candiru from a couple of weeks ago described the first public technical confirmation of zero-click mercenary spyware delivered through targeted advertising. The associated researchers said they identified at least 45 devices at Al Jazeera infected with Candiru spyware in 2024 and 2025. Citizen Lab used network logs to reconstruct a sequence in which devices contacted Discover-Tech infrastructure when advertisements loaded, followed within seconds by communications with a Candiru validation server.<\/p>\n Discover-Tech presented itself as a legitimate advertising company and maintained certified or approved vendor status with Google and IAB Europe from 2020 until earlier this month. Analysis of roughly four billion bidding records from March to June 2026 showed Discover-Tech placed about 3.77 billion bids and won roughly 442 million auctions. Ads carrying its script tags appeared across 75,373 Android and iOS apps and 120,768 websites.<\/p>\n The company spent about $109,000 during the period with no recorded conversions, which researchers cited as further evidence that the activity was not a commercial advertising business. Ads reached networks associated with NATO, the European Parliament, the U.S. Department of Defense, the International Atomic Energy Agency, and the International Criminal Court, according to Citizen Lab and a parallel investigation<\/a> by the ad security firm Confiant.<\/p>\n As part of the response to the investigation, Google terminated Discover-Tech\u2019s access to its ad exchange platforms, telling Citizen Lab it had blocked the company from bidding or serving ads across Google\u2019s ecosystem. IAB Europe<\/a> removed it from its Global Vendor List on October 8th.<\/p>\n TrendAI\u2019s Findings on Starlink Bidding<\/p>\n On the same day Citizen Lab published its report, TrendAI released an analysis<\/a> of an ad tech entity it labeled SHADOW-EARTH-79. The research examined advertising telemetry and found that the entity was the No. 1 winning bidder for ad impressions on Starlink traffic in 105 countries. It accounted for approximately 12.9% of winning advertisements in the Starlink sample, compared with a 2.6% baseline share across general traffic, a nearly fivefold over-representation and the highest lift among high-volume buyers.<\/p>\n The skew was especially pronounced in several specific countries. SHADOW-EARTH-79 captured 91.3% of observed Starlink wins in Argentina, 89.1% in the Philippines, and 82.6% in Japan. It was also the top bidder in Syria, Libya, Yemen, and South Sudan, and the No. 2 bidder in Afghanistan, markets where TrendAI noted that \u201cthe demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero.\u201d Similar dominance appeared in Hungary, Israel, Egypt, Azerbaijan, and Venezuela.<\/p>\n TrendAI concluded with moderate-to-high confidence that the bidding patterns were consistent with \u201ctargeting and tracking infrastructure rather than a commercial advertising operation.\u201d<\/p>\n The findings are particularly striking because several of the aforementioned countries restrict or prohibit Starlink, meaning that users who manage to access the service may be operating in environments where satellite connectivity is politically sensitive or subject to government scrutiny. For example, Starlink was one of a number of tools<\/a>, which also included Bitcoin and a Bitchat<\/a> clone, used by Iranian citizens in January amid anti-government protests, despite the Iranian regime\u2019s attempts to crack down on the use of the satellite internet provider. The concentration of bids on SpaceX\u2019s autonomous system therefore gave the buyer unusually strong visibility into users who might otherwise be harder to reach through conventional internet infrastructure.<\/p>\n Reuters Links SHADOW-EARTH-79 to Discover-Tech<\/p>\n On Tuesday, Reuters reported, citing six people familiar with the research, that SHADOW-EARTH-79 was TrendAI\u2019s internal codename<\/a> for Discover-Tech. The sources said researchers believed the ads were likely being used to geolocate or otherwise surveil Starlink users. TrendAI had considered naming the company in its October 15th report but ultimately did not after executives raised legal concerns, according to people familiar with the discussions.<\/p>\n The combination of the two investigations places Discover-Tech at the center of both documented spyware delivery and a broad, anomalous bidding campaign focused on Starlink traffic. While researchers have not publicly confirmed infections of Starlink devices, the same advertising infrastructure previously used to deliver Candiru spyware was the leading source of ads shown to Starlink users across more than 100 countries, including several where the service itself faces restrictions.<\/p>\n In addition to framing the TrendAI data as evidence of a worldwide surveillance operation targeting Starlink users, Scott-Railton pointed to earlier reporting from Haaretz<\/a> on Israeli companies marketing tools designed to locate Starlink terminals and, in some cases, identify their users. The advertising ecosystem\u2019s real-time bidding process, which shares detailed device and location data with every participating buyer, provides a ready mechanism for such tracking without requiring a compromise of Starlink\u2019s own infrastructure.<\/p>\n NSA whistleblower Edward Snowden has long described online advertising infrastructure as inherent surveillance rather than a side effect on how the internet works. \u201cYour smartphone broadcasts your exact location thousands of times per day to dozens of different companies. Each has the power to follow individuals wherever they go, in near-real time,\u201d he wrote <\/a>on X in 2019. \u201cThat\u2019s not a glitch in the system. It is the system.\u201d<\/p>\n Precise location data of this kind, along with other metadata associated with personal messages, financial records held by banks, and additional commercial datasets, is oftentimes made available to the highest bidder. Often, this includes various law enforcement agencies seeking to bypass traditional constitutional limits on mass surveillance, as seen in the recent case of Border Patrol using financial data<\/a> to decide who to pull over.<\/p>\n","protected":false},"excerpt":{"rendered":"Discover-Tech, an Israeli advertising firm previously linked to the delivery of zero-click spyware, is the top bidder for…\n","protected":false},"author":2,"featured_media":897462,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[48],"tags":[79,193],"class_list":["post-897461","post","type-post","status-publish","format-standard","has-post-thumbnail","category-space","tag-science","tag-space"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts\/897461","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/comments?post=897461"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts\/897461\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/media\/897462"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/media?parent=897461"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/categories?post=897461"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/tags?post=897461"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}