New Delhi: An Israeli advertising technology company heavily targeted users of SpaceX’s Starlink satellite internet service in a suspected effort to locate and monitor them, Reuters reported on Tuesday. The findings add to concerns that online advertising systems can expose sensitive information about people whose communications depend on satellite connections.
Citing six people familiar with the research, Reuters reported that researchers at TrendAI, part of Japan’s Trend Micro, had linked the activity to Discover-Tech. However, TrendAI’s published investigation identified the operator only by the codename Shadow-Earth-79, making the company’s identification a separately sourced allegation.
The distinction matters because the findings concern the exploitation of advertising infrastructure used by websites and apps. They do not, in themselves, establish that Starlink’s satellites or communications network were breached.
Unusual interest in satellite internet users
In its report published on October 15, TrendAI said Shadow-Earth-79 was the leading successful bidder for advertising impressions associated with Starlink traffic in 105 countries within its observations. It accounted for about 13 per cent of observed Starlink advertising wins, compared with a baseline share of approximately 2.6 per cent across its broader advertising activity.
The researchers also found unusually strong buying activity in conflict-affected countries, including Syria, Libya, Yemen and South Sudan. They assessed that the bidding patterns and supporting systems suggested an operation intended for tracking and targeting people, rather than conventional advertising.
These figures describe the researchers’ dataset, rather than a complete measurement of advertising across Starlink. TrendAI also acknowledged uncertainty in assigning locations to some internet addresses, including discrepancies involving Myanmar and Sudan.
Discover-Tech and its chief executive did not respond to Reuters’ requests for comment, while SpaceX also offered no response. Reuters reported that researchers had considered naming Discover-Tech in TrendAI’s report but dropped the proposal after executives raised legal concerns; TrendAI said its attribution approach sought to reduce errors and avoid misleading labels.
How advertising can become a tracking tool
The suspected mechanism involves real-time bidding, the automated auctions that decide which advertisements appear on websites and inside apps. Information accompanying an advertising opportunity can include an internet address, device identifiers and location data, allowing participating companies to assess whether to bid for access to that user.
Repeated observations can help connect a device’s activity across different sessions and networks, gradually building a picture of its user. Separately, code delivered with an advertisement can collect additional information, extending the surveillance opportunity beyond the auction itself.
In a parallel investigation, the advertising security company Confiant described Discover-Tech infrastructure capable of identifying device characteristics and communicating with a remote command system. It also documented connections to infrastructure associated with the commercial spyware vendor Candiru.
Confiant assessed that Discover-Tech’s cookie-matching systems generated billions of observations each month across tens of thousands of websites. Such activity, it said, could help maintain a large database connecting internet addresses, browser information and advertising identifiers without requiring expenditure on individual advertising campaigns.
Separate investigation found spyware infections
The University of Toronto’s Citizen Lab investigation, which RNA Media had carried on October 15, went further, reporting that devices at Al Jazeera had been infected with Candiru spyware through targeted advertisements purchased by Discover-Tech. It called the technique “AdFection”, describing attacks that could take place when an advertisement appeared, without the user clicking on it.
That finding concerns a separate set of documented attacks and does not establish that the Starlink users identified in TrendAI’s research suffered spyware infections. It nevertheless demonstrates how advertising access can potentially support both reconnaissance and the subsequent compromise of selected devices.
Citizen Lab said Google and several other advertising businesses acted to restrict or disconnect Discover-Tech following disclosures. In responses published by the researchers, Comcast’s Beeswax said it had removed the company, while Vungle said it had paused access pending a review.
The security implications are particularly significant where satellite internet provides connectivity during conflict or disruption to terrestrial networks. The investigations illustrate a weakness that can persist regardless of how an internet connection is delivered: websites and apps may expose identifying information through the advertising services they use.