An Israeli ad company just got caught spying on Starlink users worldwide
1 hour ago · 27 October 2026Share
Starlink user terminal in Capioví, Misiones Province, Argentina. Horacio Cambeiro · CC BY 4.0
An Israeli ad tech company has been running a global surveillance operation on Starlink users.
And advertising was the weapon.
Researchers at TrendAI, a unit of the Japanese cybersecurity company Trend Micro, found the company, Discover-Tech, was heavily targeting Starlink users. The likely goal? To spy on them. That's what Reuters is reporting today.
Here's how big it was. Discover-Tech was the number one bidder on Starlink ad traffic in more than 100 countries. Some of those countries don't even allow Starlink to operate.
So why didn't we know the name sooner? TrendAI's first report came out 12 days ago, on 15 October. It didn't name Discover-Tech. It called the operation Shadow-Earth-79.
But on that same day, two other groups blew the cover off. The Canadian watchdog Citizen Lab and the New York firm Confiant each published their own reports. Both named the company directly: Discover-Tech. Six people familiar with the matter have now told Reuters that Shadow-Earth-79 and Discover-Tech are the same company.
Now here's why this matters so much. Starlink is critical for Ukraine's military. Frontline communication. Directing drone strikes. Reuters points to that as the reason this targeting is dangerous, though it hasn't confirmed Ukrainian Starlink users were actually hit.
So how did the surveillance actually work? This is the twist.
Discover-Tech operated inside the ad auction system. That's the process that decides, in a fraction of a second, which advert shows up on your phone or laptop. TrendAI researchers say quote "the ads were likely being used to geolocate or otherwise surveil them".
Citizen Lab and Confiant go further. They say that same process can leak a user's data straight back to whoever is bidding on the ad slot. Over time, they wrote, bidders can collect that data, merge it with other information, and use it to track people around the web — and in some cases set them up for targeting with spyware.
The rest of this story is for members.
Matam hi-tech park located at the southern entrance to Haifa, Israel, is the largest and oldest dedicated hi-tech park in Israel. File photo. Zvi Roger · CC BY 3.0
And the scale is huge. Citizen Lab went through nearly four billion Discover-Tech ad bidding records. Its ads turned up on almost 200,000 different websites and apps between March and June this year.
The ads weren't just anywhere. Citizen Lab found them inside dozens of sensitive networks — media organisations, governments, technology companies. NATO. The United Nations. Confiant separately found the ads inside the US Department of Defense, the International Atomic Energy Agency and the International Criminal Court.
Al Jazeera was one of the named targets. At least 45 of its devices were hit with zero-click spyware attacks in 2024 and 2025. Citizen Lab links those attacks, with high confidence, to spyware made by Candiru, delivered through Discover-Tech's ads. Candiru was blacklisted by the US Commerce Department in 2021 for malicious cyber activity. It now operates under a new name, Integrity Labs, after being bought out in 2025. Al Jazeera Media Network says it condemns the spyware attacks targeting a number of its staff, and wants those responsible held accountable.
There's more. TrendAI's October report also found Discover-Tech was the top ad buyer in Syria, Libya, Yemen and South Sudan. And the second-biggest in Afghanistan.
Discover-Tech isn't some random startup either. Eric Banoun sat on its board from 2020 until January this year. Haaretz describes him as one of the pioneers of offensive cyber in Israel. The company's chief executive is Dekel Boni.
The ad industry has already started cutting Discover-Tech off. Google and Comcast's Beeswax platform, along with other ad exchanges, removed or suspended the company from their systems around three to four weeks ago, once the investigations started surfacing.
How big is the reach, really? Confiant co-founder Jerome Dangu told Haaretz the company was pumping out at least 10 million ads a day worldwide. He said very likely hundreds of millions of people had been touched by it. That number hasn't been confirmed in Citizen Lab's own report.
And Discover-Tech still hasn't said a word. Neither has its chief executive, over the past two weeks, Reuters reports. SpaceX, which runs Starlink, hasn't responded either.
So what don't we know? Whether Israel's government or military was involved in any of this. How much of the collected data was actually used. And how many of the devices served these ads were ever infected with spyware, rather than just tracked. Citizen Lab itself says being served an ad is not proof of infection.
And this warning came before. Five months ago, Haaretz and Intelligence Online reported that Israeli-owned businesses were already pitching clients on ways to track Starlink users, with advertising data at the centre of the method. Now researchers say they've found the company actually doing it.
Nothing here was paid for by an advertiser. Members are the entire business model. Bronze is where it starts, and it opens the last seven days in full.
