Israeli Firm Discover-Tech Used Starlink Ad Bids for Surveillance
Discover-Tech allegedly used digital advertising auctions to geolocate and surveil Starlink users across 100 countries, leading Google and Comcast to ban the firm.
Researchers at TrendAI, a unit of Trend Micro, uncovered a surveillance operation codenamed Shadow-Earth-79 that targeted users of SpaceX's Starlink satellite internet service across more than 100 countries. The operation allegedly used automated advertising auctions to geolocate and de-anonymize users, with implausibly high bidding volumes in conflict zones such as Yemen, Syria, Libya, South Sudan, and Afghanistan where legitimate Western advertising demand is nearly zero.
While TrendAI focused on suspicious bidding patterns, reports from Citizen Lab and Confiant explicitly identified the Israeli firm Discover-Tech as the actor behind the activity. These investigations linked Discover-Tech's infrastructure to the delivery of Candiru spyware, confirming that 45 Windows devices belonging to Al Jazeera employees were compromised via zero-click malicious advertisements between 2024 and 2025. The activity is particularly significant given the Ukrainian military's reliance on Starlink for frontline communications and drone strikes.
In response to the findings, Google, Comcast, and Beeswax removed Discover-Tech from their advertising platforms and terminated its exchange access. Discover-Tech and SpaceX have not responded to requests for comment.
