Signs of massive surveillance of Starlink users discovered
An Israeli advertising company, which has already been linked to the distribution of spy software without user interaction, has been particularly successful in advertising auctions for Starlink users in 105 countries.
Malware comes specifically through advertising
This made security researchers suspicious. They see this as evidence of a possible global surveillance campaign that targets users of SpaceX’s satellite internet. That reports Reuters citing several people familiar with the investigation. At the center is the company Discover-Tech. It had previously been noticed in a study by the Canadian research institute Citizen Lab. Accordingly, the company is said to have distributed advertisements through which Candiru’s spy software was installed unnoticed on the devices of employees of the Arabic news channel Al Jazeera. Those affected didn’t even have to click on an ad. Researchers identified at least 45 infected devices from 2024 and 2025.
Candiru, now operating under the name Integrity Labs, develops surveillance tools for smartphones and computers. The US government placed the company on a trade restrictions list in 2021 because its technology was said to have been used to monitor journalists, activists and government officials. A separate analysis by security firm TrendAI provided further evidence of Discover-Tech’s activities. Researchers examined advertising data and found that a company known as SHADOW-EARTH-79 was the most successful in advertising for Starlink users in 105 countries.
According to Reuters, this is the internal code name for Discover-Tech. The company’s share of the advertising auctions won in the Starlink database examined was around 12.9 percent. In general internet traffic it was only 2.6 percent. The dominance was particularly noticeable in Argentina with 91.3 percent, in the Philippines with 89.1 percent and in Japan with 82.6 percent. Discover-Tech was also ahead in Syria, Libya, Yemen and South Sudan.
Strange commandments
Since Starlink is restricted or banned in some of these countries, the data could provide insights into users whose Internet access is particularly politically sensitive. TrendAI rates the pattern as medium to high confidence, indicating a targeted collection and monitoring infrastructure rather than a run-of-the-mill advertising business. The behavior also seems unusual economically: Between March and June 2026, Discover-Tech spent around $109,000 (around 94,000 euros) on advertising without any measurable conversions being registered. At the same time, ads using the company’s scripts appeared in more than 75,000 apps and on over 120,000 websites.
These included networks with connections to NATO, the US Department of Defense and the European Parliament. Google has now banned Discover-Tech from its advertising platforms. IAB Europe also removed the company from its list of approved advertising providers. A successful attack on Starlink devices has not yet been proven. Rather, the researchers suspect that advertising technology could be used to determine location and track. Real-time advertising auctions provide participating companies with technical device information and location data. This means that the advertising infrastructure can potentially be used for monitoring without having to compromise Starlink’s systems themselves.
Research Snipers is currently covering all technology news including Google, Apple, Android, Xiaomi, Huawei, Samsung News, and More. Research Snipers has decade of experience in breaking technology news, covering latest trends in tech news, and recent developments. Can be reached at author1@researchsnipers.com
