Starlink users were heavily targeted with online ads in a suspected surveillance operation linked to Israeli company Discover-Tech, Reuters reported on October 27, citing six people familiar with the findings.
The reporting builds on an October 15 investigation by TrendAI, part of Trend Micro. Its public report calls the operator SHADOW-EARTH-79 without naming a company. Reuters' sources identified that operator as Discover-Tech.
TrendAI found that the operator bought 12.9% of the Starlink ad impressions in one analysis, compared with 2.6% across its broader sample. It also ranked first for Starlink advertising bids in 105 countries in the researchers' observations.
Those figures describe advertising activity visible to the researchers, not the percentage of Starlink subscribers being watched. The study covered a single ad-buying platform and acknowledged limits to its visibility and IP-based geolocation.
The route is through ads inside websites and apps. Advertising auctions can expose information such as a device's IP address, location and identifiers to bidders. That information can help an operator identify and follow particular users without breaking into their internet provider's network.
A separate Citizen Lab investigation published October 15 linked Discover-Tech ads to Candiru spyware infections at Al Jazeera. Citizen Lab said Google and several other advertising platforms had cut off or restricted Discover-Tech's access. Those findings concern a separate set of attacks and don't establish that Starlink users in TrendAI's sample were infected.
Reuters said SpaceX, Discover-Tech and its chief executive had not responded to its requests for comment. TrendAI told Reuters its attribution policy was intended to reduce mistakes and avoid misleading labels.
For subscribers, the concern is what apps and advertising networks can learn about a connected device. The reports do not establish a breach of Starlink's satellite network or show that every subscriber was targeted.
TrendAI recommends limiting ad-supported apps and unnecessary permissions, disabling ad personalization and filtering advertising traffic on sensitive devices. It also warns that simply hiding an ad may leave the tracking request intact.
