Israeli Firm Accused of Hunting Starlink Users Through Online Ads

An Israeli advertising company accused of helping deliver mercenary spyware was buying its way onto Starlink users’ screens around the world, according to researchers’ findings and six sources cited by Reuters on Tuesday.

The company is Discover-Tech. Reuters’ sources identified it as the business behind Shadow-Earth-79, an unnamed bidder in an October 15 report by TrendAI. The cybersecurity researchers found that bidder ranked first for Starlink advertising traffic in 105 countries within the data they examined.

For people using satellite internet to escape local network controls, that offers an unsettling route back into view. An advertisement auction can expose a device’s address, identifiers and location information to companies competing to reach it. A surveillance operator can assemble those fragments into a profile before a target clicks anything.

TrendAI found an unusually concentrated interest in Starlink traffic. Its report describes a bidder whose recovered application code included features for identifying users and injecting scripts. The researchers assessed with moderate-to-high confidence that the operation served surveillance and targeting purposes.

The evidence has limits: TrendAI examined one advertising platform, and its country counts describe its own observations. Its published report did not identify Discover-Tech. That identification rests on Reuters’ sources; the findings do not demonstrate that every Starlink user reached by an ad was tracked or infected.

A separate Citizen Lab investigation explains how far the advertising machinery can reach. The University of Toronto researchers linked spyware infections at Al Jazeera to advertisements bought through Discover-Tech. At least 45 devices were targeted during attacks in 2024 and 2025; that figure is a targeting count, rather than a tally of confirmed infections.

Citizen Lab identified a Discover-Tech platform called Controlium that lets customers select individual users and arrange the delivery of code through advertisements. Its researchers described an infrastructure connecting the advertising market with mercenary spyware suppliers. Even when a device received no spyware payload, an ad could still send information back.

The disclosures have already cost the company access. Citizen Lab said Google cut Discover-Tech off from its advertising exchanges, Beeswax removed it from its buying platform, Liftoff suspended access pending a review, and Eskimi blocked its accounts and domains.

Discover-Tech and its chief executive did not respond to Reuters’ requests for comment over two weeks. SpaceX also did not respond. TrendAI defended its cautious attribution policy, saying it sought to reduce mistakes. The public findings do not identify a government directing the Starlink targeting.