Every time a webpage loads, a silent auction takes place. In a fraction of a second, advertisers bid for the space on your screen, and to help them decide, the auction hands over scraps of information about you: your device, your rough location, your connection. For most people that is the price of free content. For someone sending messages over a Starlink dish in a conflict zone, it may be something else entirely.
According to six people familiar with the matter who spoke to Reuters reporter Raphael Satter, researchers at TrendAI, a unit of the Japanese cybersecurity company Trend Micro, concluded that the Israeli ad-tech company Discover-Tech was among the largest buyers of ads shown to Starlink users, and that the purpose was most likely to geolocate or watch them.
The sources said the company was the top bidder on Starlink traffic in more than 100 countries, some of them places where Starlink is banned or restricted. Discover-Tech and its chief executive did not answer Reuters’ requests for comment over two weeks. SpaceX did not respond either.
TrendAI published its findings on October 15 but never named Discover-Tech. Instead, it described an unnamed ad-tech actor it codenamed “Shadow-Earth-79”. Reuters’ sources say that codename refers to Discover-Tech.
The report found that this actor was the biggest ad buyer in Syria, Libya, Yemen and South Sudan, and the second-biggest in Afghanistan, places where there is almost no genuine demand for Western advertising. It also won an unusually large share of auctions in countries including Hungary, Israel, Egypt, Azerbaijan and Venezuela. TrendAI concluded the pattern looked like tracking infrastructure, not a commercial ad business.
Five of Reuters’ sources said researchers wanted to name the company but dropped the idea after executives raised legal concerns. TrendAI did not directly explain the omission, saying only that its attribution policy aims to avoid “hype-driven labels” and mistakes.
On the same day, two other groups did name the company. The Citizen Lab, a research unit at the University of Toronto, concluded that Discover-Tech purchased advertisements with built-in spyware, and linked attacks on at least 45 devices at Al Jazeera in 2024 and 2025 “with high confidence” to Candiru spyware delivered through Discover-Tech ads. Citizen Lab analysed nearly four billion Discover-Tech ad bids recorded between March and June 2026.
The New York ad-security firm Confiant, investigating in parallel, found signs of ad impressions on the networks of the U.S. Department of Defense, the International Atomic Energy Agency and the International Criminal Court. Citizen Lab itself stresses that an ad appearing on a network is not by itself enough to confirm targeting or infection.
Google, Comcast and other firms have since removed Discover-Tech from their platforms, Reuters reported. One person familiar with the matter, plus a seventh source, told the agency that a large US tech company and an international organisation have opened internal inquiries into whether their staff were targeted.
Starlink terminals send data via SpaceX satellites instead of national telecom networks, which means they can bypass local censorship and keep working in places where governments have lost control of the ground. That makes them valuable to Ukrainian soldiers, who use the service for frontline communication and drone strikes, and a headache for governments that want to know who is online. In May, Haaretz and Intelligence Online separately reported that Israeli-owned firms were offering clients ways to find Starlink users, with Haaretz noting ad data appeared central to the method.
The reluctance to name names is not unique to TrendAI. Earlier this year, Reuters reported that Palo Alto Networks removed explicit references to China from a cyberespionage report despite its researchers’ confidence. Palo Alto rejected suggestions this was linked to its business in China, calling them speculative and false.
The ad auction was built to sell shoes. If the researchers are right, it has quietly become one of the cheapest surveillance tools on the planet, and few in the industry seem eager to say who is using it.