Israeli ad tech firm accused of spyware links heavily targeted Starlink users, Reuters reports, citing sources

As of 5:24 p.m. ET, Oct. 27, 2026

Researchers at a cybersecurity firm concluded that Israeli ad tech company Discover-Tech was heavily targeting users of SpaceX's Starlink satellite internet service, likely in an effort to geolocate or otherwise surveil them, Reuters reported Tuesday, citing six people familiar with the matter.

The researchers work at TrendAI, a unit of Tokyo-based Trend Micro. TrendAI published a report on Oct. 15 about an ad buyer targeting Starlink users but did not name the company, calling it "an ad tech entity" under the code name SHADOW-EARTH-79. The six people told Reuters reporter Raphael Satter that SHADOW-EARTH-79 is TrendAI's code name for Discover-Tech.

TrendAI's report says SHADOW-EARTH-79 was the No. 1 bidder on Starlink traffic in 105 countries it observed and accounted for about 13% of winning bids in that traffic, about five times the average of roughly 3% for other bidders. The report says the entity was also among the top bidders for ads in sanctioned and active-conflict countries "where there is no legitimate commercial advertising demand." Bidding refers to the automated auctions advertisers use to win space in people's browsers and apps.

TrendAI's researchers were convinced Discover-Tech was behind the activity and discussed naming it, but dropped the idea after company executives raised legal concerns, five of the sources told Reuters. TrendAI did not directly address why its report did not name the company. In a statement to Reuters, it said its approach to attribution was meant to reduce the risk of mistakes and avoid "hype-driven labels."

SpaceX did not respond to Reuters' requests for comment. Discover-Tech and its chief executive did not respond to requests for comment over two weeks, Reuters said.

Spyware accusations

On the same day TrendAI published its report, Canadian research group Citizen Lab and New York ad tech firm Confiant named Discover-Tech and said it abused the ad bidding process. Citizen Lab said devices at the news network Al Jazeera were infected with spyware from Candiru, which it said has rebranded as "Integrity Labs," through targeted ads that Discover-Tech bought. Citizen Lab said Discover-Tech presents itself as an advertising company but operates as a facilitator for multiple mercenary spyware partners.

Citizen Lab's report does not discuss Starlink. Neither the TrendAI nor the Citizen Lab report says Starlink's own systems were compromised. TrendAI's report describes ad bidding on traffic from Starlink users.

After those reports, Google, Comcast and other companies said they had removed Discover-Tech from their ad platforms, Reuters reported. At least one large U.S. tech company and one international organization have opened internal inquiries into whether Discover-Tech's ads targeted their employees, according to one of the six sources and a seventh person, Reuters said.

Starlink terminals route data through SpaceX satellites rather than national telecommunications companies, which lets them get around local internet restrictions. Ukraine's military relies on the service for frontline communications, Reuters noted.

What is not known

TrendAI has not publicly confirmed that SHADOW-EARTH-79 is Discover-Tech, and that link rests on Reuters' anonymous sources. It is not known who, if anyone, received data from the Starlink-focused bidding, whether any Starlink user was infected with spyware as a result, or how SpaceX has responded. Discover-Tech has not publicly responded to the accusations in the sources reviewed for this report.