A Spyware Firm Allegedly Managed to Track Journalists and Other Targets Through Starlink Across 100 Countries: Report

An Israeli advertising technology company allegedly targeted users of Elon Musk’s Starlink satellite internet service across more than 100 countries, potentially using online advertisements to track their locations and monitor their activities, according to a new report.

Researchers at TrendAI, a division of Japanese cybersecurity company Trend Micro, concluded that Discover-Tech was behind an unusually large volume of advertising directed at Starlink users, according to six people familiar with the investigation who spoke to Reuters.

The suspected operator was the leading bidder for advertising space involving Starlink traffic in 105 countries, accounting for approximately 13% of winning bids across the researchers’ dataset. That was nearly five times its share of advertising traffic overall.

TrendAI identified the activity under the codename Shadow-Earth-79 but did not publicly name the company responsible. The six sources told Reuters that the codename referred to Discover-Tech, an Israeli firm already accused of using digital advertising systems for surveillance.

The investigation examined advertising auctions, the automated process through which companies bid to display ads on websites and mobile applications. These systems can expose information about users’ devices, internet connections and approximate locations to participating advertisers.

By collecting and combining those details over time, an operator could potentially identify individuals or monitor their online activities without directly accessing their internet accounts.

TrendAI researchers said the bidding patterns were more consistent with surveillance-related data collection than ordinary commercial advertising.

Starlink, operated by SpaceX, provides internet access through satellites rather than relying entirely on conventional ground-based telecommunications networks. The service has become particularly important in remote regions and conflict zones, including Ukraine, where military forces use it for communications and drone operations.

Satellite connectivity can also allow users to bypass domestic internet restrictions, making their locations and activities of particular interest to governments seeking to monitor communications.

TrendAI found that Shadow-Earth-79 was the leading advertising bidder across all observed traffic in Syria, Libya, Yemen and South Sudan, and ranked second in Afghanistan.

The operation also commanded unusually large shares of advertising activity in several other countries. It accounted for approximately 91% of observed winning bids in Hungary, 90% in Israel, 77% in Egypt and 75% in Azerbaijan.

Researchers identified Starlink-related advertising activity in Cameroon, Syria, Sudan, Myanmar and Libya, countries where the service faces regulatory restrictions. They cautioned that internet address geolocation is not always precise, although they cross-checked the results against Starlink’s published network location data.

TrendAI said the patterns indicated that Shadow-Earth-79 was likely operating infrastructure intended for tracking and targeting rather than conventional advertising.

The findings establish suspicious advertising activity involving Starlink connections, but do not independently confirm that particular users were successfully identified or subjected to spyware attacks.

The allegations follow separate investigations published on October 15 by the University of Toronto’s Citizen Lab and advertising security company Confiant, both of which identified Discover-Tech by name.

Citizen Lab found that the company’s advertising infrastructure had been used to deliver spyware developed by Candiru, an Israeli surveillance software company blacklisted by the U.S. Commerce Department in 2021.

Researchers confirmed that 45 Windows devices belonging to employees of Al Jazeera were compromised between 2024 and 2025 through malicious advertisements.

The technique, described as a zero-click attack, allowed spyware to infect devices without requiring users to click a link or download a file.

Following the investigations, Google removed Discover-Tech from its advertising vendor registries and terminated its access to the company’s advertising exchanges in early October. Comcast’s advertising technology business, Beeswax, and other platforms also took action to restrict the firm’s access.

At least one major U.S. technology company and one international organization have since launched internal inquiries into whether their employees were targeted by Discover-Tech advertisements, Reuters reported, citing people familiar with the matter.

The newspaper also found that TrendAI researchers had considered publicly identifying Discover-Tech in their Oct. 15 report but abandoned the idea after company executives raised legal concerns, according to five sources.

TrendAI did not directly explain why it withheld the name, saying its approach to attribution was intended to avoid errors and misleading labels that could affect cybersecurity investigations.

Discover-Tech and its chief executive did not respond to Reuters’ requests for comment over the preceding two weeks. SpaceX also did not respond.