Israeli Ad Tech Firm Accused on Using Online Ads to Track Starlink Users

Israeli advertising company Discover-Tech is accused of using online ads to track people connected to SpaceX’s Starlink satellite internet service. Reuters reported on October 27 that six people familiar with the research said TrendAI researchers linked the company to unusually heavy advertising activity aimed at Starlink users.

The findings raise concerns about how routine advertising systems can expose people in sensitive locations. However, the allegations concern the misuse of advertising data, not a confirmed breach of Starlink’s satellites or network. Starlink’s role in conflict zones makes such exposure serious for people whose location could put them at risk.

TrendAI, a unit of Trend Micro, published its findings on October 15 under the name SHADOW-EARTH-79. Its public report did not identify Discover-Tech. Reuters’ sources said the codename referred to the Israeli company, while five sources said legal concerns led executives to withhold its name.

Online Ads Track Starlink Users

The suspected tracking relies on real-time bidding, the automated auctions that decide which ads appear inside websites and apps. During these auctions, bidders can receive device information, including IP addresses, network identifiers, advertising IDs, and sometimes location data.

Researchers examined traffic associated with Starlink’s network identifier, AS14593. Combining network details with persistent advertising identifiers can help operators link activity across browsing sessions and build profiles of users without requiring them to click an advertisement.

TrendAI found SHADOW-EARTH-79 was the leading winning bidder for observed Starlink advertising traffic in 105 countries. Across a separate comparison, it received 12.9% of Starlink ad impressions against a 2.6% share across overall traffic, showing a strong focus on satellite internet users.

Importantly, these figures describe TrendAI’s sample, not the entire advertising market. The study relied on data from one advertising buying platform. Researchers also warned that country estimates based on IP addresses carry uncertainty, including differences involving Myanmar and Sudan.

The operation also ranked first among observed ad buyers in Syria, Libya, Yemen, and South Sudan. TrendAI said these patterns, alongside reconstructed software features, suggested tracking infrastructure rather than normal commercial advertising.

Researchers studied publicly available JavaScript bundles to reconstruct parts of the operation’s customer interface. They identified functions linked to identifying users behind anonymous identifiers and manually inserting scripts, features consistent with intelligence gathering.

Separate investigations by Citizen Lab and Confiant named Discover-Tech on October 15. Cybersecurity News previously covered their findings in its report on zero-click spyware delivered through online ads. That reporting also stressed that receiving a Discover-Tech advertisement does not prove a device was infected.

The wider danger of trusted advertising infrastructure has also appeared in Cybersecurity News coverage of the Adform advertising platform compromise. That separate incident involved malicious scripts, rather than evidence of the Starlink-focused operation described here.

Google, Comcast, and other companies said they removed Discover-Tech from their advertising platforms following the investigations, Reuters reported. SpaceX, Discover-Tech, and its chief executive did not respond to Reuters’ requests for comment.

TrendAI recommends restricting advertising traffic on sensitive devices, limiting permissions, disabling ad personalization, and reducing reliance on ad-supported apps. It warns that tools which merely hide advertisements may leave tracking requests active. Defenders should instead favor controls that stop sensitive data reaching advertising systems. The report does not establish that every exposed Starlink user was tracked or infected.

AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?

The post Israeli Ad Tech Firm Accused on Using Online Ads to Track Starlink Users appeared first on Cyber Security News.