Alleged Israeli Spy Firm Heavily Targeted Global Starlink Users Through Ad Bidding

Cybersecurity researchers have uncovered a massive, suspected surveillance operation targeting users of SpaceX's Starlink satellite internet service. An Israeli advertising technology firm, Discover-Tech, allegedly exploited the digital ad bidding process to track and geolocate terminals across more than 100 countries. The discovery exposes a novel vector for global espionage that bypasses traditional network compromises.[1][2]

Digital advertising relies on a complex, real-time auction system where advertisers bid milliseconds before a page loads to secure space inside browsers. According to researchers at TrendAI, a unit of Tokyo-based cybersecurity company Trend Micro, Discover-Tech aggressively dominated these auctions specifically for Starlink traffic. The firm accounted for approximately 12.9% of winning advertisements in the Starlink sample.[1]

This win rate represents a nearly fivefold over-representation compared to a 2.6% baseline share across general internet traffic. When an advertiser wins a bid, the Real-Time Bidding process can leak sensitive metadata back to the buyer, including IP addresses and device identifiers. Canadian cyber watchdog Citizen Lab and New York-based ad tech firm Confiant subsequently identified Discover-Tech by name.[1][2]

Exploiting Real-Time Bidding

The exploitation of ad networks for surveillance relies on the structural vulnerabilities of the bidding ecosystem. Because ad exchanges broadcast user data to dozens of potential bidders simultaneously to solicit the highest price, participants can harvest location data even if they lose the auction. By consistently bidding high and winning, Discover-Tech ensured its code executed directly on target devices.[1][4]

This method allows intelligence gatherers to bypass end-to-end encryption and virtual private networks by targeting the browser environment itself. John Scott-Railton, a senior researcher at the University of Toronto's Citizen Lab, characterized the TrendAI data as evidence of a "worldwide surveillance op targeting @Starlink users." The tactic transforms mundane digital advertisements into precision tracking beacons.[2]

The targeting was particularly pronounced in regions where Starlink faces regulatory restrictions or outright bans, suggesting a strong intelligence-gathering motive. TrendAI telemetry revealed that Discover-Tech captured 91.3% of observed Starlink ad wins in Argentina, 89.1% in the Philippines, and 82.6% in Japan. The firm effectively became the number one bidder on Starlink traffic globally, outspending legitimate commercial advertisers.[2]

Tracking satellite internet has become a high-priority industry for governments worldwide, particularly as the hardware sidesteps local internet restrictions. Starlink terminals are heavily relied upon by the Ukrainian military for frontline communications and directing drone strikes. In May 2026, the Israeli newspaper Haaretz reported that Israeli-owned businesses were actively pitching clients on methods to identify Starlink terminals using ad data.[1][5]

Ties to Mercenary Spyware

Discover-Tech has previously faced severe scrutiny for its role in distributing advanced surveillance tools. On October 15, Citizen Lab named the firm as the buyer of ordinary-looking advertisements that delivered zero-click mercenary spyware to devices belonging to Al Jazeera journalists. The malware infected at least 45 devices across 2024 and 2025 without requiring any user interaction.[2]

The spyware delivered in those attacks was developed by Candiru, an Israeli mercenary spyware vendor that has since rebranded as Integrity Labs. The U.S. Department of Commerce's Bureau of Industry and Security added Candiru to its trade restriction Entity List in 2021. The agency cited concerns that the company supplied surveillance technology used to target journalists, activists, and government officials.[2]

Citizen Lab's initial report on Discover-Tech provided the first public technical confirmation of zero-click mercenary spyware delivered through targeted advertising. Unlike traditional phishing campaigns that require a target to click a malicious link, the ad-based delivery mechanism compromises the device silently in the background. The Starlink campaign utilizes the exact same advertising infrastructure previously used to deliver the Candiru payloads.[2]

The scale of the ad-bidding operation has prompted alarm across the corporate sector. At least one major U.S. technology company and one international organization have recently launched internal inquiries to determine whether Discover-Tech's advertisements targeted their employees. TrendAI's report noted that the suspicious bidding patterns suggested the entity was running "targeting and tracking infrastructure rather than a commercial advertising operation."[1][4]

Industry Fallout and Response

Following the investigations, major technology companies have taken immediate action to sever ties with the firm. Google, Comcast, and several other platforms removed Discover-Tech from their advertising networks to prevent further data harvesting. Discover-Tech and its chief executive have not responded to requests for comment over the past two weeks, and SpaceX has also declined to address the tracking campaign.[1][6]

Reflecting broader industry trends, TrendAI initially avoided naming the firm in its October 15 report to prevent "hype-driven labels." The cybersecurity company cited concerns that unstable actor names can mislead network defenders and trigger inappropriate response actions. However, the subsequent public identification by Citizen Lab and Confiant forced the industry to confront the specific vendor driving the surveillance architecture.[1]

The campaign underscores the unique vulnerabilities of satellite internet deployments in hostile environments. While the satellite link itself may be secure, the downstream traffic remains susceptible to standard web-based tracking mechanisms. For dissidents, journalists, and military units relying on Starlink to evade terrestrial network monitoring, the ad-tech ecosystem represents a critical blind spot.[2][3]

The revelations are likely to increase regulatory pressure on the digital advertising industry to audit its participants more rigorously. Privacy advocates have long warned that the Real-Time Bidding system functions as a massive, unregulated data broker that can be easily weaponized by state-sponsored actors. The Discover-Tech incident provides concrete evidence that these theoretical risks have materialized into active, global surveillance operations.[1][3]