Starlink users heavily surveilled by alleged Israeli spy firm — company served ads to geolocate users and spy on browsers and apps
An Israeli company is alleged to have launched a spy campaign using malicious ads targeting Starlink usersThe ads do not have to be clicked on, just served to the user to begin collecting dataThe ads were served to Starlink users across more than 100 countries
An alleged Israeli spy firm has been spotted snooping on Starlink users on an industrial scale by a digital defense firm.
These are the conclusions of research by Trend Micro’s AI cybersecurity unit TrendAI, whose researchers analyzed troves of digital advertising data. The research found that Israeli company Discover-Tech was the number one bidder on Starlink advertising traffic.
The surveillance was targeted at Starlink units across more than 100 countries - including regions with Starlink restrictions - and used malicious adverts to harvest user data across browsers and applications.
Starlink users surveilled by ads
Initially, TrendAI did not directly name Discover-Tech as the perpetrator of the alleged surveillance campaign, instead referring to them as “Shadow-Earth-79”. Discover-Tech is the same firm that was alleged to have targeted Al Jazeera journalists with malicious adverts earlier this month, as exposed by Citizen Lab.
As Starlink terminals route traffic through a network of satellites in orbit, they can circumvent local internet restrictions and are a useful way to stay connected during blackouts - such as those experienced by Ukraine - or government enforced internet shutdowns - such as those that affected Iran at the start of 2026.
But this circumvention also makes them lucrative targets for governments or authorities looking to track Starlink units on their turf.
As Starlink only provides the connection to the internet, adverts can still be served on webpages, and this is the critical piece of this puzzle. As Cofiant noted in their own report, Discover-Tech abused the ad bidding process to serve adverts that harvest critical data about the users that see them. Some adverts can collect data as the user trawls the internet, creating a de-anonymized profile that can set them up for further surveillance.
The advert doesn’t even have to be clicked on. As long as it is served to the user, it can begin tracking.
The TrendAI researchers noted an “obvious skew” towards bidding on advertising space that would target Starlink users, with Discover-Tech being the number one ad-buyer across Syria, Libya, Yemen and South Sudan despite the fact that “the demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero.”
Google, Comcast, and multiple other companies have since removed Discover-Tech from their ad platforms.
