Israeli Ad-Tech Firm Discover-Tech Tied to Suspected Starlink Tracking Bid

An Israeli advertising technology company placed the winning bids for ad space tied to Starlink traffic in more than 100 countries, including markets where the satellite service is banned, Reuters reported, citing six people familiar with the matter. Researchers at Trend Micro's TrendAI unit suspect the bidding was designed to reveal user locations or enable further monitoring, though the findings do not show that anyone was actually tracked.

The company at the center of the report is Discover-Tech, an Israeli ad-tech firm. TrendAI first described the activity in an October 15 report under the codename "Shadow-Earth-79," without naming a company. According to the Reuters account, that codename belongs to Discover-Tech.

TrendAI stresses caution in how it names suspects. "Our approach reduces the risk of misattribution, hype-driven labels, and unstable actor names that can mislead defenders, distort risk prioritization, and trigger inappropriate response actions," the report states. The attribution remains a research assessment, not a legal finding.

How does the ad-auction mechanism work?

The suspected campaign exploits the real-time auctions that sell online advertising. Advertisers bid for space on websites and apps, and each bid request can carry details about the person on the other end of the connection. Collected over time and combined with other data, that information could be used to identify people, follow their activity across the web, or select targets for spyware.

The tactic turns an ordinary commercial pipeline into a collection tool. No malicious code is required; the data arrives as a routine part of how ads are bought and sold.

Why did the bidding pattern raise suspicion?

The geography, more than the volume, drew attention. Shadow-Earth-79 was reportedly the largest ad buyer in Syria, Libya, Yemen and South Sudan, and the second largest in Afghanistan. It also claimed unusually large shares of bids in Hungary, Israel, Egypt, Azerbaijan and Venezuela.

TrendAI says this pattern points to "targeting and tracking infrastructure rather than a commercial advertising operation." That reading is plausible because little legitimate Western advertising demand exists in sanctioned or war-torn markets. In short, the spending made commercial sense only as surveillance.

What did Citizen Lab and Confiant find?

Discover-Tech was already under scrutiny when the TrendAI report landed. On the same day, October 15, Citizen Lab and the ad security firm Confiant separately named the company. They alleged it used ad auctions to collect data on users across sensitive networks, including those tied to media organizations, governments and technology firms.

Citizen Lab's statement was direct: "The malicious advertisements were purchased by Discover-Tech, an Israeli company that presents itself as a legitimate advertising company, but which we found operates as a facilitator for multiple mercenary spyware partners."

How have platforms responded?

Google and Comcast have removed Discover-TTech from their advertising platforms, both companies confirmed. The report also says a major U.S. technology company and an international organization have opened internal inquiries into whether the firm's ads targeted their employees.

Neither Discover-Tech nor SpaceX has commented publicly.

Why does Starlink make this a geopolitical story?

Starlink operates outside conventional telecom networks, which makes it a lifeline where governments restrict internet access — and makes its users an attractive target for those same governments. In April, Iran's nationwide internet blackout passed 1,000 hours, with authorities reportedly pursuing Starlink terminals and imposing severe penalties for possessing one. Earlier this month, SpaceX limited Starlink service for Ukraine's high-speed military drones, a move Ukrainian officials say complicates logistics and operations.

Abuse of advertising and consumer technology for tracking is not new. A backdoor was previously found in a popular iOS ad library that could collect device-location data and capture screenshots. Chrysaor, Android spyware linked to the Pegasus family, was discovered by Lookout and Citizen Lab on a small number of devices. More recently, a researcher claimed to have found extensive data collection, including ad-related telemetry, inside a Samsung smart TV's Tizen operating system, though those findings remain under investigation.

The open question is whether Discover-Tech actually used Starlink-related data to single out specific subscribers; that link remains unverified. Until platforms close the data leaks built into real-time bidding, the auction mechanism will stay a cheap and quiet way to map who is online, and where.