A suspected surveillance operator gained access to global digital advertising auctions for years before major platforms cut it off this month. Now a newly reported link to Starlink traffic raises a second question: how much of its activity could be identified publicly while the firm remained unnamed in a major cybersecurity report?
Reuters reported Tuesday, citing six people familiar with the research, that Israeli advertising company Discover-Tech operated Shadow-Earth-79, the advertiser identified by TrendAI as unusually active on internet connections associated with SpaceX’s Starlink service.
Discover-Tech was already the subject of a separate October 15 investigation by the University of Toronto’s Citizen Lab, connecting its advertising infrastructure to spyware delivery, but did not establish that Starlink customers had been infected.
Sponsored · Selkirk Copper Mines
TrendAI analyzed advertising telemetry collected from June 2024 through June 2026. It found Shadow-Earth-79 was the leading winning bidder in observed Starlink-related auctions in 105 countries.
Across the entire Starlink sample, the operation accounted for 12.9% of winning advertisements against a 2.6% baseline share across traffic, nearly five times its ordinary presence.
Its share of observed Starlink wins reached 91.3% in Argentina, 89.1% in the Philippines, and 82.6% in Japan.
Advertising auctions expose details about devices and connections to potential buyers. A winning advertiser can also place code in an ad, creating opportunities to profile a user or pursue an intrusion without compromising satellite infrastructure.
Sponsored · Cambria Gold Mines
According to Citizen Lab, Alphabet removed Discover-Tech from Google’s advertising vendor registries during the first week of October. IAB Europe removed it from its approved-vendor list on October 8. Comcast’s Beeswax also severed access.
While that ended some routes into advertising inventory, it did not produce an industrywide accounting of previous exposure. Citizen Lab found Discover-Tech had been listed as a Google advertising vendor since 2020, with its advertisements appearing on more than 120,000 websites and 75,000 apps.
Citizen Lab additionally documented spyware infections involving 45 Windows devices at Al Jazeera between 2024 and 2025, which it linked to Candiru through Discover-Tech-purchased advertising.
Reuters separately reported that TrendAI researchers considered naming Discover-Tech, but executives raised legal concerns, according to five people familiar with the matter.
Neither study establishes a Starlink network breach, identifies the purchaser of any Starlink-focused intelligence, or demonstrates that surveillance of those connections continues today.
The newly named operator nevertheless puts scrutiny on the digital advertising industry’s ability to identify abusive buyers before outside researchers do.
