Israeli Spy Firm Used Malicious Ads to Pinpoint Starlink Users

Turning programmatic ad auctions into surveillance feeds

Commercial ad networks let buyers target narrow IP ranges and network providers, allowing surveillance operators to bid specifically on traffic coming from satellite terminals.

Starlink has become an essential communications lifeline across conflict zones, sanction-heavy regions, and disaster areas. That same visibility makes its user base a prime target for state intelligence units and commercial tracking contractors looking to bypass traditional telecom monitoring.

According to research from Trend Micro's TrendAI unit, an Israeli firm called Discover-Tech systematically weaponized real-time ad bidding to identify and monitor terminals worldwide. Initially tracked under the moniker Shadow-Earth-79, the operation bought up ad real estate that specifically targeted satellite connections.

The footprint was unmistakable. Trend Micro noted that Discover-Tech became the dominant ad purchaser across active conflict zones including Syria, Yemen, Libya, and South Sudan. In areas where commercial consumer ad demand from legitimate Western businesses is virtually nonexistent, the entity was spending heavily just to serve code to these satellite terminals.

How the tracking works without a single click

The operation did not rely on standard malware payloads or tricking targets into giving up access. Much like how a zero-permission Android bug let rogue apps hijack Microsoft tokens, the scheme exploited ambient system behaviors—specifically, the core architecture of programmatic advertising.

When an advert loads inside a standard webpage or mobile app, the underlying code executes telemetry scripts. These scripts pull hardware fingerprints, inspect browser environments, and harvest network data. By analyzing how that traffic routes through Starlink ground stations and user dishes, operators can correlate an IP address with physical geography, stripping away the anonymity people assume satellite links provide.

Earlier investigations by Citizen Lab linked the same entity to malicious ad targeting against Al Jazeera journalists. In response to the latest findings, major ad exchanges including Google and Comcast severed ties with Discover-Tech to plug the pipeline.

What it means for users worldwide

While the surveillance campaign focused heavily on sanctioned and active war zones, Trend Micro confirmed the targeting footprint touched Starlink users across more than 100 countries, encompassing commercial, civilian, and maritime terminals globally.

Because the vector relies on standard online ad impressions rather than an intrusion into Starlink's satellite constellation, endpoint defenses remain effective: running network-wide DNS blocklists or aggressive browser-based content blockers stops these surveillance scripts before the ad auctions ever deliver their payload to your screen.