APEP BAR | INVESTIGATION — November 3, 2026. A satellite internet connection can help someone communicate when a government has shut down ordinary networks. But what if the advertisements appearing on that connection reveal clues about the person using it?
That is the unsettling question raised by an October 15 investigation from TrendAI Research, followed by an October 27 Reuters report. TrendAI found an advertiser it called SHADOW-EARTH-79 making an extraordinary volume of bids on traffic associated with SpaceX’s Starlink service. Reuters reported, citing six people familiar with the research, that this was the Israeli advertising company Discover-Tech.
The company’s name had already surfaced in another, technically detailed investigation. On October 15, the University of Toronto’s Citizen Lab and advertising-security firm Confiant described how Discover-Tech’s systems allegedly connected ordinary ad exchanges to tracking and commercial spyware operations.
Advertising was supposed to sell products. In these findings, it could also help identify people, follow devices and—under particular conditions—deliver spyware without a click.
The Starlink finding: 105 countries and a very unusual bidder
TrendAI studied a 90-day sample of advertising traffic. In the Starlink IP-address space it observed, SHADOW-EARTH-79 accounted for 12.9% of the recorded Starlink ad impressions in its comparison—nearly five times the advertiser’s approximately 2.6% baseline share across all observed traffic. It was the leading winning bidder on Starlink-associated traffic in 105 countries, according to the report.
Those numbers demand careful reading. The entity was not the largest Starlink bidder by raw global volume in the report; it ranked second on that measure. What stood out was how disproportionately interested it appeared to be in Starlink users. A high share of winning bids is a sign of reach and possible targeting, not a count of people successfully hacked.
TrendAI also identified the entity as the top bidder in 49 countries across the broader set of ad traffic it analyzed. The study specifically flagged activity in or around sensitive and conflict-affected locations, including Syria, Libya, Yemen and South Sudan. Some apparent Starlink locations were in countries where the service was restricted or banned; the researchers cautioned that IP-based geolocation has margins of error, including mismatches in the geographic data associated with certain Starlink addresses.
There is a reason this pattern matters. A Starlink terminal can keep people connected where terrestrial infrastructure is unreliable, destroyed or politically controlled. A tool that can identify patterns of use on such networks has possible intelligence value. But identifying a bid pattern cannot establish the precise physical location of every terminal, the identity of every user or the ultimate client directing the advertising campaign.
How an ad auction becomes a surveillance opportunity
Open a website or app that sells advertising and, in a fraction of a second, automated exchanges may ask advertisers to bid for the chance to show you something. That process is called real-time bidding.
The bid request can reveal much more than a vacant rectangle on a screen. Depending on the system and user settings, it may include an IP address, approximate location, device characteristics, app or site context, and advertising identifiers. Companies receiving these signals can combine observations across sessions, link them to other identifiers and potentially build a picture of a device’s movements and interests.
Not every ad bidder receives the same information, and an IP address is not a GPS coordinate. Still, the architecture makes personal signals available to a chain of intermediaries that most internet users have never heard of. An advertiser may learn useful information simply by participating in the auction; winning a bid gives it the additional opportunity to place code or tracking resources in the user’s browser or app.
TrendAI assessed with moderate-to-high confidence that SHADOW-EARTH-79’s overall activity resembled targeting and tracking infrastructure more than conventional commercial advertising. That is a research assessment based on observed behavior, not a public court finding about who commissioned it.
Discover-Tech and the zero-click spyware connection
The Starlink findings become more serious when placed next to the Citizen Lab investigation, Exposing AdFection. Researchers connected Discover-Tech to an advertising platform called Controlium that, they found, could select particular devices for profiling or malicious-code delivery using ad identifiers and IP-address information.
Citizen Lab documented attacks involving devices at Al Jazeera in 2024 and 2025. The researchers reported that at least 45 devices were targeted in a campaign they linked with high confidence to spyware made by Candiru, also known as Integrity Labs. Their technical analysis included network logs showing a sequence from ad delivery to spyware infrastructure, as well as malware evidence recovered from a compromised device.
That is the distinction between a worrying theory and a documented attack chain. The researchers were not simply saying spyware might arrive by advertisement. They described instances in which it did. The technique they named AdFection can work without the target clicking the advertisement: loading the ad may be enough to initiate the attack on a selected device.
Citizen Lab’s review of nearly four billion exposed Discover-Tech bidding records also found the firm’s ads appearing across more than 120,000 websites and 70,000 mobile apps between March and June 2026. Confiant independently estimated that Discover-Tech served roughly 10 million ad impressions per day, and described extensive device profiling and cookie-matching activity.
Important limit: An ad impression is not proof of a spyware infection. The same reports that reveal the machinery also warn against treating every person who encountered an ad as an identified or hacked target. The evidence of Al Jazeera compromises should not be casually extended to all Starlink users.
Our earlier article, The Ad You Never Clicked: Researchers Uncover a Zero-Click Spyware Pipeline, examines that original zero-click investigation in more detail. The Starlink bidding pattern is the significant follow-up.
Why the apparently ordinary ads were suspicious
Confiant’s researchers found that much of the operation’s ad inventory did not resemble a straightforward effort to sell products. Some ads sent people to affiliate offers, while a substantial portion promoted a free IP-information service linked to Discover-Tech. The firm appeared to be spending heavily to obtain access to audiences without an obvious comparable advertising revenue stream.
The researchers also described technical mechanisms that gathered device data or shared identifiers between advertising systems. Such practices can help form an identity graph—a collection of clues that makes a person or device recognizable across separate browsing sessions. In the wrong hands, that graph is not merely a marketing asset. It may be a target list.
Citizen Lab identified links between Discover-Tech and multiple businesses associated with commercial surveillance, including Candiru and Intelos. Those relationships, the observed technical systems and the ad-bidding records together underpin the researchers’ assessment. They do not publicly establish the complete list of end customers or prove that one named state intelligence agency ordered the Starlink targeting.
Google and Comcast cut access—but the bigger problem remains
The disclosures prompted action from major parts of the ad industry. Citizen Lab reported that Google terminated Discover-Tech’s access to its ad exchanges in early October 2026 and removed it from approved-vendor arrangements. Beeswax, the advertising platform owned by Comcast’s FreeWheel, removed Discover-Tech from its buying platform. IAB Europe removed it from relevant lists, while Vungle (Liftoff) paused access and Eskimi blocked associated accounts and domains, according to the researchers’ correspondence with those companies.
These responses matter. But removing one company is not the same as fixing the underlying incentives and data flows. Real-time bidding still depends on audience information traveling rapidly through interconnected systems, and the reports suggest that a sophisticated actor can blend surveillance with routine-looking commercial transactions.
Reuters reported that Discover-Tech and its chief executive did not respond to its requests for comment about the Starlink findings. SpaceX also did not respond to Reuters. Their silence must not be treated as an admission. The public evidence warrants scrutiny regardless of whether further responses arrive.
What is proven, what is alleged—and what remains unanswered
Documented: TrendAI measured highly unusual Starlink-oriented bidding by an actor it called SHADOW-EARTH-79. Citizen Lab and Confiant separately published technical evidence of Discover-Tech’s surveillance-oriented advertising infrastructure and its connections to a confirmed spyware delivery route against Al Jazeera devices.
Reported attribution: Reuters, citing six people familiar with the matter, identified Discover-Tech as the entity behind TrendAI’s SHADOW-EARTH-79 codename. TrendAI itself did not name the company in the public Starlink report.
Not established publicly: That every Starlink bid represented an identified individual; that every exposed user was infected; that all reported IP locations reflected precise physical positions; or that a specific government directed every aspect of the operation. Those are different claims and require different evidence.
There are steps users and organizations can take to reduce exposure: limit ad-supported apps on sensitive devices, disable or reset advertising identifiers where supported, review tracking permissions, keep software patched and filter untrusted advertising content in higher-risk settings. TrendAI also recommended restricting advertising traffic and personalization for people working in sensitive environments. None of those precautions guarantees protection against a targeted exploit.
We have spent years asking how much of our lives advertisers know. These investigations raise a sharper question: what happens when the tools built to find the perfect customer are used to find the perfect surveillance target?
Watch: the supplied Discover-Tech explainer
The following short video is commentary supplied with this story. Its publication date was not independently confirmed here. Use the linked research and reporting below for the underlying evidence.
Watch the supplied Discover-Tech short on YouTube (contextual commentary; not primary-source evidence; link provided as fallback if video embedding is unavailable).
Primary sources and further reading
- TrendAI Research (October 15, 2026): Invasive Ads: The Unconventional Cyber Surveillance Attack Surface — original Starlink bidding analysis.
- Citizen Lab (October 15, 2026): Exposing AdFection — original technical investigation into Discover-Tech and zero-click spyware.
- Confiant (October 15, 2026): ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming — independent ad-telemetry analysis.
- Reuters (October 27, 2026): Alleged Israeli spy company heavily targeted Starlink users, sources say — reporting on the identity attributed to SHADOW-EARTH-79 and efforts to obtain comment.
Featured photo: Real Starlink satellite internet user terminals aboard a ship. Photograph by Ka23 13 (January 11, 2025), Wikimedia Commons, CC BY 4.0, used without modification. Contextual image; not documentary evidence of the Discover-Tech operation.
