By Kyle Torpey
The findings suggest possible surveillance interest in countries where Starlink is banned or restricted.
Discover-Tech, an Israeli advertising firm previously linked to the delivery of zero-click spyware, is the top bidder for Starlink ad impressions in 105 countries, according to a new report from Reuters. Researchers say it all points to a large-scale tracking effort aimed at users of SpaceX’s satellite internet service.
John Scott-Railton, a senior researcher at the University of Toronto’s Citizen Lab, posted on X that data from TrendAI suggest the existence of a “worldwide surveillance op targeting @Starlink users.”
Discover-Tech was previously named in Citizen Lab’s October 15th report as the buyer of ordinary-looking ads that delivered Candiru spyware to devices at Al Jazeera without any user interaction. Candiru is an Israeli mercenary spyware vendor (now rebranded as Integrity Labs) that develops tools capable of silently compromising phones and computers. In 2021, the U.S. Department of Commerce’s Bureau of Industry and Security added Candiru to their trade restriction list, known as the Entity List, over concerns it supplied surveillance technology used against journalists, activists, and government officials.
Citizen Lab’s initial report on Discover-Tech and Candiru from a couple of weeks ago described the first public technical confirmation of zero-click mercenary spyware delivered through targeted advertising. The associated researchers said they identified at least 45 devices at Al Jazeera infected with Candiru spyware in 2024 and 2025. Citizen Lab used network logs to reconstruct a sequence in which devices contacted Discover-Tech infrastructure when advertisements loaded, followed within seconds by communications with a Candiru validation server.
Discover-Tech presented itself as a legitimate advertising company and maintained certified or approved vendor status with Google and IAB Europe from 2020 until earlier this month. Analysis of roughly four billion bidding records from March to June 2026 showed Discover-Tech placed about 3.77 billion bids and won roughly 442 million auctions. Ads carrying its script tags appeared across 75,373 Android and iOS apps and 120,768 websites.
The company spent about $109,000 during the period with no recorded conversions, which researchers cited as further evidence that the activity was not a commercial advertising business. Ads reached networks associated with NATO, the European Parliament, the U.S. Department of Defense, the International Atomic Energy Agency, and the International Criminal Court, according to Citizen Lab and a parallel investigation by the ad security firm Confiant.
As part of the response to the investigation, Google terminated Discover-Tech’s access to its ad exchange platforms, telling Citizen Lab it had blocked the company from bidding or serving ads across Google’s ecosystem. IAB Europe removed it from its Global Vendor List on October 8th.
TrendAI’s Findings on Starlink Bidding
On the same day Citizen Lab published its report, TrendAI released an analysis of an ad tech entity it labeled SHADOW-EARTH-79. The research examined advertising telemetry and found that the entity was the No. 1 winning bidder for ad impressions on Starlink traffic in 105 countries. It accounted for approximately 12.9% of winning advertisements in the Starlink sample, compared with a 2.6% baseline share across general traffic, a nearly fivefold over-representation and the highest lift among high-volume buyers.
The skew was especially pronounced in several specific countries. SHADOW-EARTH-79 captured 91.3% of observed Starlink wins in Argentina, 89.1% in the Philippines, and 82.6% in Japan. It was also the top bidder in Syria, Libya, Yemen, and South Sudan, and the No. 2 bidder in Afghanistan, markets where TrendAI noted that “the demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero.” Similar dominance appeared in Hungary, Israel, Egypt, Azerbaijan, and Venezuela.
TrendAI concluded with moderate-to-high confidence that the bidding patterns were consistent with “targeting and tracking infrastructure rather than a commercial advertising operation.”
The findings are particularly striking because several of the aforementioned countries restrict or prohibit Starlink, meaning that users who manage to access the service may be operating in environments where satellite connectivity is politically sensitive or subject to government scrutiny. For example, Starlink was one of a number of tools, which also included Bitcoin and a Bitchat clone, used by Iranian citizens in January amid anti-government protests, despite the Iranian regime’s attempts to crack down on the use of the satellite internet provider. The concentration of bids on SpaceX’s autonomous system therefore gave the buyer unusually strong visibility into users who might otherwise be harder to reach through conventional internet infrastructure.
Reuters Links SHADOW-EARTH-79 to Discover-Tech
On Tuesday, Reuters reported, citing six people familiar with the research, that SHADOW-EARTH-79 was TrendAI’s internal codename for Discover-Tech. The sources said researchers believed the ads were likely being used to geolocate or otherwise surveil Starlink users. TrendAI had considered naming the company in its October 15th report but ultimately did not after executives raised legal concerns, according to people familiar with the discussions.
The combination of the two investigations places Discover-Tech at the center of both documented spyware delivery and a broad, anomalous bidding campaign focused on Starlink traffic. While researchers have not publicly confirmed infections of Starlink devices, the same advertising infrastructure previously used to deliver Candiru spyware was the leading source of ads shown to Starlink users across more than 100 countries, including several where the service itself faces restrictions.
In addition to framing the TrendAI data as evidence of a worldwide surveillance operation targeting Starlink users, Scott-Railton pointed to earlier reporting from Haaretz on Israeli companies marketing tools designed to locate Starlink terminals and, in some cases, identify their users. The advertising ecosystem’s real-time bidding process, which shares detailed device and location data with every participating buyer, provides a ready mechanism for such tracking without requiring a compromise of Starlink’s own infrastructure.
NSA whistleblower Edward Snowden has long described online advertising infrastructure as inherent surveillance rather than a side effect on how the internet works. “Your smartphone broadcasts your exact location thousands of times per day to dozens of different companies. Each has the power to follow individuals wherever they go, in near-real time,” he wrote on X in 2019. “That’s not a glitch in the system. It is the system.”
Precise location data of this kind, along with other metadata associated with personal messages, financial records held by banks, and additional commercial datasets, is oftentimes made available to the highest bidder. Often, this includes various law enforcement agencies seeking to bypass traditional constitutional limits on mass surveillance, as seen in the recent case of Border Patrol using financial data to decide who to pull over.
