Israeli Ad Firm Discover Tech Accused of Targeting Starlink Users for Surveillance

Israeli advertising technology company Discover Tech allegedly targeted Starlink users through online advertising in a suspected surveillance operation, Reuters reported on October 27, 2026 , citing six people familiar with research by TrendAI, Trend Micro’s research unit.

The report identified the company behind an advertiser that researchers had previously described only by a codename. The evidence concerns advertising directed at devices using Starlink connections, not a demonstrated breach of its satellites, terminals, or underlying network.

As of October 28, the public findings do not establish how many individual Starlink users were successfully identified or located, or who commissioned the activity.

What the Starlink Research Found

In research published October 15, TrendAI described an advertiser called SHADOW EARTH 79 as the leading winning bidder for Starlink related advertising in 105 countries within its observed data.

Over a 90 day comparison, the advertiser received 12.9% of observed Starlink advertising impressions, compared with 2.6% of advertising overall. That represented roughly fivefold overrepresentation.

Those figures describe TrendAI’s dataset, not the entire advertising market or all Starlink traffic. Its analysis covered a single advertising buying platform and acknowledged uncertainty in determining locations from IP addresses.

TrendAI assessed with moderate to high confidence that the activity served tracking and targeting rather than ordinary marketing. It cited the concentration on Starlink traffic, dominant bidding in markets affected by conflict or sanctions, and technical features consistent with intelligence gathering.

Reuters’ sources identified the advertiser as Discover Tech. TrendAI did not publicly name the company. Reuters said researchers considered doing so, but executives raised legal concerns; TrendAI emphasized caution to avoid misattribution.

How Advertising Could Enable Tracking

The alleged method involves phones, computers and browsers using Starlink, rather than intercepting satellite signals.

Advertising auctions and delivered ads can expose identifiers and device or network information. Combining repeated observations with other datasets could support identification, profiling, and location tracking, according to the researchers.

A separate October 15 investigation by Citizen Lab described Discover Tech as connecting advertising systems with commercial surveillance vendors. Its evidence included platform screenshots, code, infrastructure analysis and nearly four billion exposed bidding records.

Citizen Lab also linked Discover Tech infrastructure to Candiru spyware attacks targeting at least 45 Al Jazeera devices during 2024 and 2025, with evidence of infections. That separate investigation does not prove that Starlink users received spyware. Seeing a Discover Tech ad alone does not establish targeting or infection.

Responses and Unresolved Questions

Discover Tech, its chief executive, and SpaceX had not responded to Reuters’ requests for comment by its October 27 report. Their lack of response is neither a denial nor an acknowledgment.

According to Citizen Lab, Google and IAB Europe removed Discover Tech from vendor registries in early October. Google terminated its advertising exchange access, while other advertising platforms blocked, removed, or suspended it.

The latest reporting adds a company identification to the observed Starlink advertising activity. Public findings have not successfully tracked specific Starlink users, their precise locations, or the identity of any commissioning customer.