Findivoza

November 8, 2026

Findivoza

Investigations

The ads that may have been watching: how Starlink users were allegedly tracked through online advertising

Faizan Altaf

Every time you open a website or an app, a split-second auction takes place behind the screen. Advertisers bid for the chance to show you an ad, and the winner’s ad appears. It happens in milliseconds, billions of times a day, and almost nobody notices.

But according to an investigation by Reuters, published on 27 October 2026, that invisible auction may have been used as a surveillance tool — to find and follow people who use Starlink, the satellite internet service run by Elon Musk’s company SpaceX.

The investigation does not claim Starlink’s satellites were hacked, or that any individual user was definitely identified or located. What it does claim — based on research by cybersecurity experts and six people familiar with that research — is that an Israeli advertising technology company called Discover-Tech became one of the biggest buyers of ads shown to Starlink users in more than 100 countries, in what researchers believe was likely an effort to track or spy on them.

At a glance

What happened: On 27 October 2026, Reuters reported that researchers at TrendAI, the research unit of cybersecurity firm Trend Micro, had found that an Israeli ad-tech company, Discover-Tech, was the leading bidder for digital ads shown to Starlink users in 105 countries — a pattern the researchers assessed was likely surveillance, not ordinary advertising.

Why it matters: Starlink is used by soldiers, aid workers, journalists and dissidents in places where the internet is restricted or dangerous. If its users can be identified through the ads on their screens, the safety satellite internet promises is undermined.

What happens next: Google and Comcast have removed Discover-Tech from their advertising platforms, and at least one major US technology company and one international organisation have opened internal inquiries. Discover-Tech has not responded to requests for comment, and it is not yet known who, if anyone, commissioned the activity.

What the researchers found

The story begins with a technical report published on 15 October 2026 by TrendAI, the research arm of the Tokyo-based cybersecurity company Trend Micro.

TrendAI’s researchers studied digital advertising data collected through their company’s telemetry — information from security software running on devices around the world. They found an advertiser with an extraordinary pattern: it was the leading winning bidder for advertising shown to devices using Starlink connections in 105 countries. In the data they could see, it won about 12.9% of advertising shown to Starlink users, compared with about 2.6% of advertising overall — roughly five times its share in the general market. That is a strange result for a normal advertiser, and TrendAI concluded, with moderate-to-high confidence, that the activity was “targeting and tracking infrastructure rather than a commercial advertising operation”.

The pattern was most extreme where legitimate advertising is rarest. The mystery bidder was the top buyer of ads aimed at Starlink users in Syria, Libya, Yemen and South Sudan, and the second-largest buyer in Afghanistan — countries where Western companies have almost no reason to advertise. It also held what the report called an “implausibly dominant share” of bids in countries including Hungary, Israel, Egypt, Azerbaijan and Venezuela.

TrendAI did not name the company behind the activity. Instead, it gave the advertiser a codename: “Shadow-Earth-79”. The researchers discussed naming the company in their report, according to six people familiar with the matter who spoke to Reuters, but dropped the idea after TrendAI executives raised legal concerns. On 27 October, Reuters named the company: all six sources told the news agency that Shadow-Earth-79 was Discover-Tech, an Israeli advertising technology company.

How could ads be used to track someone?

To understand the allegation, it helps to understand how online advertising actually works.

When you open a webpage or an app, the space where an ad will appear is sold in a real-time auction that takes a fraction of a second. Dozens of companies can bid, and to bid sensibly they receive information about the device and the connection — things like the device’s IP address, its rough location, the type of device and the app or site being used. The winner gets to show its ad. The losers still saw the data.

This system is called real-time bidding, and it is the engine of most of the free internet. It is also, researchers have warned for years, a powerful surveillance tool: anyone who can bid in these auctions can collect information about who is using which devices, where they are, and what they are reading.

Starlink makes this especially sensitive. Starlink routes its users’ data through SpaceX-operated satellites rather than through nationally controlled networks. That lets soldiers, aid workers, journalists and dissidents get online in places where the local internet is censored, monitored or destroyed. But their devices still run apps and open websites, and those still carry ads. If an advertiser is bidding aggressively for every ad shown to a Starlink connection, it can build up a picture of who those users are and where they are, without ever touching a satellite.

Crucially, the researchers do not allege that Starlink’s satellites, terminals or underlying network were breached. The alleged method involves the phones, computers and browsers using Starlink connections — not the interception of satellite signals. And the public findings do not show that any specific Starlink user was tracked, located or infected. What they show is a pattern of bidding that researchers say looks like surveillance.

Who is Discover-Tech?

Discover-Tech is an Israeli advertising technology company. It presents itself as a legitimate participant in the digital advertising industry. Google had listed it as an advertising vendor since 2020.

But 15 October 2026 — the same day TrendAI published its report — two other organisations publicly accused Discover-Tech of something much darker.

The Citizen Lab, a cybersecurity watchdog based at the University of Toronto, and Confiant, a New York-based advertising security firm, named Discover-Tech in their own investigation. They described it as a company that presents itself as a legitimate advertiser while serving as a facilitator for mercenary spyware vendors — companies that sell hacking tools to governments and other clients.

According to the Citizen Lab, Discover-Tech’s advertising infrastructure was linked, with high confidence, to “zero-click” spyware infections of at least 45 devices belonging to Al Jazeera, the news network, during 2024 and 2025. Zero-click spyware is particularly dangerous because it can infect a phone without the owner clicking on anything at all. The spyware in question was made by Candiru, an Israeli spyware maker. The Citizen Lab said Discover-Tech’s ads ran across roughly 200,000 apps and websites.

In May 2026, the Israeli newspaper Haaretz and the website Intelligence Online separately reported that Israeli-owned businesses were pitching clients on ways to identify and track Starlink users — months before the TrendAI report was published.

The fallout so far

The response from the advertising industry has been swift. Following the investigations, Google and Comcast said they had removed Discover-Tech from their advertising platforms, and Google and IAB Europe, a European advertising industry body, removed the company from their vendor registries in early October, according to the Citizen Lab.

At least one major US technology company and one international organisation have recently launched internal inquiries into whether Discover-Tech’s ads targeted their employees, according to people familiar with the matter.

Discover-Tech and its chief executive did not respond to Reuters’ requests for comment over the two weeks before the story was published. SpaceX, which operates Starlink, also did not respond to Reuters’ requests for comment, according to the news agency. TrendAI did not directly address questions about why its report did not identify Shadow-Earth-79 by name. No government has announced charges against Discover-Tech, no regulator has published findings, and the company has not been found guilty of anything by any court. The claims against it come from researchers and from sources speaking to journalists — not from a legal ruling.

Why Starlink users are a target

Starlink is not an ordinary internet provider. Because it beams internet from satellites, it works in places where normal internet does not — or where the normal internet is controlled by a government that wants to watch, or block, what its people do online.

That makes its users unusually interesting to anyone doing surveillance. In Ukraine, Starlink has been used by the military since Russia’s full-scale invasion in 2022. In Gaza, Sudan, Myanmar and other conflict zones, aid workers and journalists have relied on it when local networks failed. Dissidents and activists in countries with heavy internet censorship have used it to get around national firewalls.

That is what makes the Reuters finding unsettling even though no individual user has been shown to have been identified. If the pattern of bidding really was surveillance, it would mean that the very people who chose Starlink because it was harder to monitor were being watched through the most ordinary thing on their screens: the advertisements.

What the reporting does — and does not — establish

Good investigations are precise about their limits, and this one has several that matter.

The data has limits. TrendAI’s figures describe the advertising traffic its researchers could see, through one advertising platform — not all advertising everywhere. The 12.9% figure is a share of the Starlink advertising TrendAI observed, not 12.9% of all Starlink users or all ads worldwide. The researchers also cautioned that estimates of a user’s country based on IP addresses carry uncertainty.

The identification rests on sources, not on the public report. TrendAI did not name Discover-Tech. The link between the company and the codename Shadow-Earth-79 comes from six people familiar with the research who spoke to Reuters — standard practice for sensitive security research, but not the same as a public document naming the company.

No specific victim has been identified. The public findings do not show that any particular Starlink user was located, identified or infected with spyware. The Citizen Lab’s findings about Al Jazeera devices concern a different, though related, set of allegations, and are a separate matter from the Starlink bidding pattern.

Nobody knows who commissioned it. If the bidding was surveillance, the public reporting does not say who paid for it or what they wanted. That question is likely to be the focus of further reporting.

Starlink itself is not accused of involvement. Nothing in the reporting suggests that SpaceX or Starlink knowingly assisted any alleged operation.

What happens next

Several questions will determine where this story goes. Will other researchers or companies publish their own data? The advertising industry holds enormous amounts of bidding data, and other firms could confirm or challenge TrendAI’s findings if they chose to look. Will regulators act? The EU, the US and other governments have been tightening rules on spyware and on the use of advertising data for surveillance, but no authority has opened a formal investigation into Discover-Tech yet. And will the advertising industry change? The real-time bidding system that makes this kind of surveillance possible has been criticised by privacy campaigners for years.

Finally, there is the question of who the client was. If Discover-Tech was running a tracking operation aimed at Starlink users in Syria, Yemen, Sudan and more than 100 other countries, somebody was paying for it.

Frequently asked questions

What is Starlink?

Starlink is a satellite internet service operated by SpaceX, the rocket company founded by Elon Musk. It provides internet access through satellites in low orbit, rather than through cables or mobile phone masts. It is used in remote areas, in conflict zones and in countries where the normal internet is restricted or unreliable.

What did the researchers actually find?

TrendAI, the research unit of cybersecurity firm Trend Micro, found that an advertiser it codenamed Shadow-Earth-79 was the leading bidder for ads shown to Starlink users in 105 countries, winning about 12.9% of the Starlink advertising it observed — about five times its share of advertising overall. The researchers assessed, with moderate-to-high confidence, that the activity was tracking infrastructure rather than ordinary advertising. Six people familiar with the research told Reuters the advertiser was the Israeli company Discover-Tech.

Were Starlink’s satellites hacked?

No — nothing in the reporting suggests that. The alleged method uses the normal online advertising system: when a Starlink user opens a website or app, advertisers bid for the ad space and receive information about the device and connection. The researchers say this data could be used to identify and locate users. The satellites and terminals themselves were not breached.

What is Discover-Tech accused of?

Two sets of allegations. First, the Reuters report says researchers linked it to heavy ad targeting of Starlink users in a likely surveillance effort. Second, the Citizen Lab and Confiant accused it of facilitating spyware vendors, linking its advertising infrastructure with high confidence to spyware infections of at least 45 Al Jazeera devices in 2024 and 2025. Discover-Tech has not responded to requests for comment, and no charges have been announced.

Has anyone been harmed?

No specific Starlink user has been publicly identified as having been tracked, located or infected as a result of the bidding pattern. The Citizen Lab’s findings about Al Jazeera devices relate to spyware infections linked to Discover-Tech’s advertising infrastructure — a related but separate allegation.

What has happened to Discover-Tech since the reports?

Google and Comcast have removed Discover-Tech from their advertising platforms, and Google and IAB Europe removed it from their vendor registries. At least one major US technology company and one international organisation have opened internal inquiries into whether their employees were targeted.

Is it illegal to use advertising data this way?

That depends on the country and on what exactly was done with the data. Using advertising systems to track people without their knowledge could breach privacy and data protection laws in several jurisdictions, and using spyware to infect devices is illegal in most countries. But no authority has announced charges or findings against Discover-Tech.

Conclusion

The Starlink story is a reminder of how surveillance works in the modern world. It rarely looks like the movies: no one needs to tap a phone line or break into a satellite. Often, it looks like something utterly ordinary — an advertisement loading on a screen.

Whether that picture is confirmed — and who was behind it — is still unknown. But the story has already changed something: the world’s biggest advertising platforms have cut ties with the company at its centre.

This article is for general information and education only. It is not legal or financial advice.

Sources

Faizan Altaf

Faizan Altaf is the founder and author of findivoza.com, a news blog covering world, Pakistan, business, technology, health and sport in plain English. He writes for general readers who want clear, trustworthy news without jargon. His work focuses on explaining what happened, why it matters, and what to watch next.

Leave a Reply

Your email address will not be published. Required fields are marked *